d58317aa45038dba12f984acf330e8b320fd02acc7dae2dbb3d552abf57378e7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WW-Unlock-All.exe
Size

37.0MB
MD5

aa4776a1f805e24a8d3a5a4f40f2c4ad
SHA1

33059aa20fb3fe4e63060ec0522f2ef6b92e8037
SHA256

d58317aa45038dba12f984acf330e8b320fd02acc7dae2dbb3d552abf57378e7
SHA512

08b3673e89bca857ad47edaadfe6f2df0152256e83dfe058cf9b7c4f8c9397173a95cf33bc571cf9377c2b56347272231ab970b77a57ff8865f9b44ae73c4c64
SSDEEP

786432:GPOf6psATJ9Udzg5TwLoIe3ODPK5tBRTwhdknCi/tQ47TNx:GPOfWsAdSdzGELoIejrnwrk7/tQ4n

Score

9^/10

bootkit evasion persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

WW-Unlock-All.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ WW-Unlock-All.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WW-Unlock-All.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WW-Unlock-All.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WW-Unlock-All.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WW-Unlock-All.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

WW-Unlock-All.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WW-Unlock-All.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

WW-Unlock-All.exe

description ioc process

File opened for modification \??\PhysicalDrive0 WW-Unlock-All.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

WW-Unlock-All.exe

pid process

2880 WW-Unlock-All.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

WW-Unlock-All.exe

pid process

2880 WW-Unlock-All.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WW-Unlock-All.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	WW-Unlock-All.exe

pid	process
2880	WW-Unlock-All.exe

pid	process
2880	WW-Unlock-All.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

WW-Unlock-All.execmd.exe

description	pid	process	target process
PID 2880 wrote to memory of 2644	2880	WW-Unlock-All.exe	cmd.exe
PID 2880 wrote to memory of 2644	2880	WW-Unlock-All.exe	cmd.exe
PID 2880 wrote to memory of 2644	2880	WW-Unlock-All.exe	cmd.exe
PID 2644 wrote to memory of 2660	2644	cmd.exe	certutil.exe
PID 2644 wrote to memory of 2660	2644	cmd.exe	certutil.exe
PID 2644 wrote to memory of 2660	2644	cmd.exe	certutil.exe
PID 2644 wrote to memory of 2664	2644	cmd.exe	find.exe
PID 2644 wrote to memory of 2664	2644	cmd.exe	find.exe
PID 2644 wrote to memory of 2664	2644	cmd.exe	find.exe
PID 2644 wrote to memory of 2704	2644	cmd.exe	find.exe
PID 2644 wrote to memory of 2704	2644	cmd.exe	find.exe
PID 2644 wrote to memory of 2704	2644	cmd.exe	find.exe

C:\Users\Admin\AppData\Local\Temp\WW-Unlock-All.exe
"C:\Users\Admin\AppData\Local\Temp\WW-Unlock-All.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\WW-Unlock-All.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\WW-Unlock-All.exe" MD5
3⤵
PID:2660

C:\Windows\system32\find.exe
find /i /v "md5"
3⤵
PID:2664

C:\Windows\system32\find.exe
find /i /v "certutil"
3⤵
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x000007FEFD4E3000-0x000007FEFD4E4000-memory.dmp

Filesize
4KB

Download
memory/2880-2-0x000007FEFD4D0000-0x000007FEFD53C000-memory.dmp

Filesize
432KB

Download
memory/2880-1-0x000007FEFD4D0000-0x000007FEFD53C000-memory.dmp

Filesize
432KB

Download
memory/2880-8-0x0000000001C20000-0x0000000001C3A000-memory.dmp

Filesize
104KB

Download
memory/2880-14-0x0000000180000000-0x0000000180081000-memory.dmp

Filesize
516KB

Download
memory/2880-24-0x000007FEFD4D0000-0x000007FEFD53C000-memory.dmp

Filesize
432KB

Download