Analysis
- max time kernel
141s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
05/06/2024, 13:26
General
- Target TwistedLoader.exe
- Size 6.3MB
- Sample240605-qpxbcshd39
- SHA256 fe4bf4127f90432d512fd211363d59f552c6741bc4625a08bca9ac2c89b86ea9
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Themida packer 22 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TwistedLoader.exe"C:\Users\Admin\AppData\Local\Temp\TwistedLoader.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /C Get-Service -Name WpnUserService* | Restart-Service -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_lgsaz1md.a2z.ps1
memory/3764-32-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-38-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-4-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-3-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-33-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-6-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-7-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-46-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-45-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-44-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-2-0x00007FFD8CF10000-0x00007FFD8CF12000-memory.dmp
memory/3764-43-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-1-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-42-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-5-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-34-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-35-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-36-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-37-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-0-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-39-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-40-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/3764-41-0x00007FF71DDD0000-0x00007FF71ED1D000-memory.dmp
memory/4264-25-0x00007FFD8CE70000-0x00007FFD8D065000-memory.dmp
memory/4264-22-0x000001DCA9FD0000-0x000001DCA9FF2000-memory.dmp
memory/4264-21-0x00007FFD8CE70000-0x00007FFD8D065000-memory.dmp
memory/4264-10-0x00007FFD8CE70000-0x00007FFD8D065000-memory.dmp
memory/4264-16-0x00007FFD8CE70000-0x00007FFD8D065000-memory.dmp