Analysis
-
max time kernel
110s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:52
Behavioral task
behavioral1
Sample
modest-menu_protected.exe
Resource
win7-20240508-en
General
-
Target
modest-menu_protected.exe
-
Size
13.7MB
-
MD5
a332fdb58a35c95a1998f281206db1cd
-
SHA1
e4af18424b1cf6ddb7053653660c22dfd6af9567
-
SHA256
83045343ee550f125be0c7125a2385dd0a4a3f8f3d7059f4db0f2f7a07a334b0
-
SHA512
f2d9a4fdad857e8100e839e3a7f76ce05aabfb4e8e2258ff170d00c2fd179ac703a00b6bd9ae162db7ef8db1a398a57f71de7e8350b775e234f34856178eb3c8
-
SSDEEP
196608:4RkKDeP+YxurapMz+x/EfmyVsBKirJ7riHaborEDA0/NQpLKzzbd200BdkOT73UV:4Rm+4w+mLVG1riHI3/n7d2RfBLVqw6
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
modest-menu_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ modest-menu_protected.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
modest-menu_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion modest-menu_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion modest-menu_protected.exe -
Processes:
resource yara_rule behavioral2/memory/3316-0-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmp themida behavioral2/memory/3316-2-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmp themida behavioral2/memory/3316-3-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmp themida behavioral2/memory/3316-4-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmp themida behavioral2/memory/3316-5-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmp themida behavioral2/memory/3316-6-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmp themida behavioral2/memory/3316-7-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmp themida behavioral2/memory/3316-8-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmp themida behavioral2/memory/3316-9-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmp themida -
Processes:
modest-menu_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA modest-menu_protected.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
modest-menu_protected.exepid process 3316 modest-menu_protected.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes:
modest-menu_protected.exetaskmgr.exepid process 3316 modest-menu_protected.exe 3316 modest-menu_protected.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 4304 taskmgr.exe Token: SeSystemProfilePrivilege 4304 taskmgr.exe Token: SeCreateGlobalPrivilege 4304 taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
Processes:
taskmgr.exepid process 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
Processes:
taskmgr.exepid process 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\modest-menu_protected.exe"C:\Users\Admin\AppData\Local\Temp\modest-menu_protected.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3316-0-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmpFilesize
34.1MB
-
memory/3316-1-0x00007FF98C310000-0x00007FF98C312000-memory.dmpFilesize
8KB
-
memory/3316-2-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmpFilesize
34.1MB
-
memory/3316-3-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmpFilesize
34.1MB
-
memory/3316-4-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmpFilesize
34.1MB
-
memory/3316-5-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmpFilesize
34.1MB
-
memory/3316-6-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmpFilesize
34.1MB
-
memory/3316-7-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmpFilesize
34.1MB
-
memory/3316-8-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmpFilesize
34.1MB
-
memory/3316-9-0x00007FF70FDD0000-0x00007FF711FEE000-memory.dmpFilesize
34.1MB
-
memory/4304-10-0x0000029A5B8D0000-0x0000029A5B8D1000-memory.dmpFilesize
4KB
-
memory/4304-11-0x0000029A5B8D0000-0x0000029A5B8D1000-memory.dmpFilesize
4KB
-
memory/4304-12-0x0000029A5B8D0000-0x0000029A5B8D1000-memory.dmpFilesize
4KB
-
memory/4304-16-0x0000029A5B8D0000-0x0000029A5B8D1000-memory.dmpFilesize
4KB
-
memory/4304-22-0x0000029A5B8D0000-0x0000029A5B8D1000-memory.dmpFilesize
4KB
-
memory/4304-21-0x0000029A5B8D0000-0x0000029A5B8D1000-memory.dmpFilesize
4KB
-
memory/4304-20-0x0000029A5B8D0000-0x0000029A5B8D1000-memory.dmpFilesize
4KB
-
memory/4304-19-0x0000029A5B8D0000-0x0000029A5B8D1000-memory.dmpFilesize
4KB
-
memory/4304-18-0x0000029A5B8D0000-0x0000029A5B8D1000-memory.dmpFilesize
4KB
-
memory/4304-17-0x0000029A5B8D0000-0x0000029A5B8D1000-memory.dmpFilesize
4KB