7a0fc390552b21b671a9f87934ab161bab03e08cef9383c24e66300894f14ec5

Analysis

max time kernel
79s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UNLOCK ALL.exe
Size

13.2MB
MD5

4388bf1bacc99fb238d16a3885066755
SHA1

d7adf519cd3c188e6f9f99dc78c6e4510320beb6
SHA256

22d3b9f8872c784da7f2fe39ae826c36e6a373f07568043aa40a234b9f73047b
SHA512

9a3b0b7b85d99705c437b72d65b1a2fd1bb03d4fbff637225422680e0fa871ad0251e6c83dea9c866c429a9258865e439ccf976340b765882ec9cf5f0b36c7ab
SSDEEP

393216:YKv8XedcqxSu2gI7+GXEG1FcSCQE5uYPxNDMQ+s8P:YKTrP95GXE5LQE5Jbxy

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

UNLOCK ALL.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ UNLOCK ALL.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	UNLOCK ALL.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UNLOCK ALL.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	UNLOCK ALL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	UNLOCK ALL.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UNLOCK ALL.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	UNLOCK ALL.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

UNLOCK ALL.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA UNLOCK ALL.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UNLOCK ALL.exe

Drops file in System32 directory 6 IoCs

Processes:

UNLOCK ALL.exe

description	ioc	process
File opened for modification	C:\Windows\System32\IME\IMETC\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	UNLOCK ALL.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2899}	UNLOCK ALL.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444}	UNLOCK ALL.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	UNLOCK ALL.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	UNLOCK ALL.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2869}	UNLOCK ALL.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

UNLOCK ALL.exe

pid process

4468 UNLOCK ALL.exe

pid	process
4468	UNLOCK ALL.exe

Drops file in Windows directory 4 IoCs

Processes:

UNLOCK ALL.exe

description	ioc	process
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE}	UNLOCK ALL.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2893}	UNLOCK ALL.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2892}	UNLOCK ALL.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	UNLOCK ALL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

powershell.exeUNLOCK ALL.exe

pid	process
668	powershell.exe
668	powershell.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe
4468	UNLOCK ALL.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

UNLOCK ALL.exe

pid process

4468 UNLOCK ALL.exe

pid	process
4468	UNLOCK ALL.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powercfg.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	64	powercfg.exe
Token: SeCreatePagefilePrivilege	64	powercfg.exe
Token: SeShutdownPrivilege	64	powercfg.exe
Token: SeCreatePagefilePrivilege	64	powercfg.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeSystemEnvironmentPrivilege	668	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

UNLOCK ALL.execmd.execmd.exe

description	pid	process	target process
PID 4468 wrote to memory of 2848	4468	UNLOCK ALL.exe	cmd.exe
PID 4468 wrote to memory of 2848	4468	UNLOCK ALL.exe	cmd.exe
PID 4468 wrote to memory of 3980	4468	UNLOCK ALL.exe	cmd.exe
PID 4468 wrote to memory of 3980	4468	UNLOCK ALL.exe	cmd.exe
PID 3980 wrote to memory of 668	3980	cmd.exe	powershell.exe
PID 3980 wrote to memory of 668	3980	cmd.exe	powershell.exe
PID 2848 wrote to memory of 64	2848	cmd.exe	powercfg.exe
PID 2848 wrote to memory of 64	2848	cmd.exe	powercfg.exe
PID 4468 wrote to memory of 448	4468	UNLOCK ALL.exe	cmd.exe
PID 4468 wrote to memory of 448	4468	UNLOCK ALL.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\UNLOCK ALL.exe
"C:\Users\Admin\AppData\Local\Temp\UNLOCK ALL.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C Powercfg -h off
2⤵
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\system32\powercfg.exe
Powercfg -h off
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:64

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell "Confirm-SecureBootUEFI" > C:\secureboot_status.txt
2⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "Confirm-SecureBootUEFI"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s0pgnhsz.ygf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\secureboot_status.txt

Filesize
420B

MD5
de582b589ac295c03fcf52ca102a28c0

SHA1
10cc2b1adb41e11abb33383ab102ff204379afa4

SHA256
86aea26372f98f717f138713881a44bdb3b9ac666f70328398ceea2ae15d3c1f

SHA512
af023664d90c322d6d2c4cd2988e6a5eb23e4506bec588b9247a4e9f11baf0f21c9941e6dde5e3440719ceb2d2c154c6f853d5082a0f2b7c22c8a50fed0cc81d

Download Submit
memory/668-14-0x00000120F86E0000-0x00000120F8702000-memory.dmp

Filesize
136KB

Download
memory/4468-0-0x0000000140000000-0x0000000141DA8000-memory.dmp

Filesize
29.7MB

Download
memory/4468-1-0x00007FFC162D0000-0x00007FFC162D2000-memory.dmp

Filesize
8KB

Download
memory/4468-2-0x0000000140000000-0x0000000141DA8000-memory.dmp

Filesize
29.7MB

Download
memory/4468-3-0x0000000140000000-0x0000000141DA8000-memory.dmp

Filesize
29.7MB

Download
memory/4468-4-0x0000000140000000-0x0000000141DA8000-memory.dmp

Filesize
29.7MB

Download
memory/4468-20-0x0000000140000000-0x0000000141DA8000-memory.dmp

Filesize
29.7MB

Download