Overview
overview
9Static
static
7UB Downloa...ir.exe
windows7-x64
1UB Downloa...ir.exe
windows10-2004-x64
8UB Downloa...or.exe
windows7-x64
9UB Downloa...or.exe
windows10-2004-x64
9UB Downloa...ix.bat
windows7-x64
1UB Downloa...ix.bat
windows10-2004-x64
1UB Downloa...h2.exe
windows7-x64
5UB Downloa...h2.exe
windows10-2004-x64
5UB Downloa...ix.bat
windows7-x64
9UB Downloa...ix.bat
windows10-2004-x64
9UB Downloa...ix.bat
windows7-x64
1UB Downloa...ix.bat
windows10-2004-x64
1UB Downloa...b1.exe
windows7-x64
5UB Downloa...b1.exe
windows10-2004-x64
5UB Downloa...ix.bat
windows7-x64
9UB Downloa...ix.bat
windows10-2004-x64
9Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 10:20
Behavioral task
behavioral1
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Loud Chair.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Loud Chair.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Privacy Protector.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Privacy Protector.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/UB Silent/bsod fix.bat
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/UB Silent/bsod fix.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/UB Silent/u237cgatAh2.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/UB Silent/u237cgatAh2.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/UB Silent/w11 fix.bat
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/UB Silent/w11 fix.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Unlock All/bsod fix.bat
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Unlock All/bsod fix.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Unlock All/nRi28Wtqb1.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Unlock All/nRi28Wtqb1.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Unlock All/w11 fix.bat
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Unlock All/w11 fix.bat
Resource
win10v2004-20240709-en
General
-
Target
UB Downloads 12.6.24/UB Downloads 12.6.24/UB Downloads/Privacy Protector.exe
-
Size
8.6MB
-
MD5
fbf038e5ef2e30da99e88371531dfebc
-
SHA1
b0507491cf241aa4da8b73ef513528b2a937aa2c
-
SHA256
0890f0b89e5c5745ad4bfaf1ca6459c5b765adae9cc2d0988e9456894350b434
-
SHA512
2526c6e621b64c861aa5baddd9e80d2bdd5cd7d628be115584e3f0471536ab95ef85be48ae06b5207bc70f9e6eeeb75ceebc2594ebda6b1878cbc22f8321ea84
-
SSDEEP
196608:gAHP6FQVWZ0C1+eqy/rRXEChq+ZExY37lJo9aM2yf/2dI:KPqWRUChqCtLlW5X2dI
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Privacy Protector.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Privacy Protector.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Privacy Protector.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Privacy Protector.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Privacy Protector.exe -
Processes:
Privacy Protector.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Privacy Protector.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Privacy Protector.exepid process 2868 Privacy Protector.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Privacy Protector.exepid process 2868 Privacy Protector.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\UB Downloads 12.6.24\UB Downloads 12.6.24\UB Downloads\Privacy Protector.exe"C:\Users\Admin\AppData\Local\Temp\UB Downloads 12.6.24\UB Downloads 12.6.24\UB Downloads\Privacy Protector.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2868