66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Downloads 12.6.24/Downloads 12.6.24/Downloads/Blocker v2.exe
Size 12.4MB
Sample240811-3bewdaybpc
SHA256 deae15597f320e6c3b7b655947a6ef9459027790d452f5e1f2559b15ce50a2df
MD5 a9c090dde54cb5f996b3e15da5fe3b08
SHA1 e799961d2a957c2b84dc6ff32e73c5cabe45a395
SHA512 21e1a2d4e14399ecf3e5d085d0017b756ba8821708c8d5601c718fea356af1b701e60d2d61d8cdaabd7e962975d5bf230e6d421ac1e620556e3d8c605e1f87d8
SSDEEP 393216:6Pyeiimo7NiqXDCzcQ9Lnp/4ygyeF53i4F2CucQOuons:T9imoMMS1/pgyeFNiS2CEp
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Blocker v2.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Blocker v2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Blocker v2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Blocker v2.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1696	powercfg.exe
2004	cmd.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2869}	Blocker v2.exe
File opened for modification	C:\Windows\System32\IME\IMETC\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2899}	Blocker v2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2576	Blocker v2.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2892}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2893}	Blocker v2.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2752	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2428	powershell.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1696	powercfg.exe
Token: SeShutdownPrivilege	1696	powercfg.exe
Token: SeShutdownPrivilege	1696	powercfg.exe
Token: SeShutdownPrivilege	1696	powercfg.exe
Token: SeShutdownPrivilege	1696	powercfg.exe
Token: SeCreatePagefilePrivilege	1696	powercfg.exe
Token: SeDebugPrivilege	2428	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2004	2576	Blocker v2.exe	32
PID 2576 wrote to memory of 2004	2576	Blocker v2.exe	32
PID 2576 wrote to memory of 2004	2576	Blocker v2.exe	32
PID 2576 wrote to memory of 1396	2576	Blocker v2.exe	33
PID 2576 wrote to memory of 1396	2576	Blocker v2.exe	33
PID 2576 wrote to memory of 1396	2576	Blocker v2.exe	33
PID 1396 wrote to memory of 2428	1396	cmd.exe	35
PID 1396 wrote to memory of 2428	1396	cmd.exe	35
PID 1396 wrote to memory of 2428	1396	cmd.exe	35
PID 2004 wrote to memory of 1696	2004	cmd.exe	36
PID 2004 wrote to memory of 1696	2004	cmd.exe	36
PID 2004 wrote to memory of 1696	2004	cmd.exe	36
PID 2576 wrote to memory of 2868	2576	Blocker v2.exe	37
PID 2576 wrote to memory of 2868	2576	Blocker v2.exe	37
PID 2576 wrote to memory of 2868	2576	Blocker v2.exe	37
PID 2576 wrote to memory of 2888	2576	Blocker v2.exe	38
PID 2576 wrote to memory of 2888	2576	Blocker v2.exe	38
PID 2576 wrote to memory of 2888	2576	Blocker v2.exe	38
PID 2576 wrote to memory of 2904	2576	Blocker v2.exe	39
PID 2576 wrote to memory of 2904	2576	Blocker v2.exe	39
PID 2576 wrote to memory of 2904	2576	Blocker v2.exe	39
PID 2576 wrote to memory of 2872	2576	Blocker v2.exe	40
PID 2576 wrote to memory of 2872	2576	Blocker v2.exe	40
PID 2576 wrote to memory of 2872	2576	Blocker v2.exe	40
PID 2872 wrote to memory of 2752	2872	cmd.exe	42
PID 2872 wrote to memory of 2752	2872	cmd.exe	42
PID 2872 wrote to memory of 2752	2872	cmd.exe	42

C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Blocker v2.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Blocker v2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C Powercfg -h off
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\powercfg.exe
    Powercfg -h off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Confirm-SecureBootUEFI" > C:\secureboot_status.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Confirm-SecureBootUEFI"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc delete windowsproc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\sc.exe
    sc delete windowsproc
    3⤵
    - Launches sc.exe
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

secureboot_status.txt

Path C:\secureboot_status.txt
Size 447B
SHA256 7fc3a10f21c5405061e1eff734790d1a640ddc1971a84e60070288af8bb161d3
MD5 cf8355d29a9d97cf5d6a673e64f9fcda
SHA1 9050f2dd8c50258f22fea4278268357d4133668f
SHA512 9669cb9c7100047e4f0c0478edc3c390fde9fa8ae98e5aaf4c204520f6eb3e57c11eb388f72986afd21781c24b2796c39e1aa291d34f481b0de9c94b81bd1a48
MD5 SHA1 SHA512

Submit Download

memory/2428-10-0x00000000026E0000-0x00000000026E8000-memory.dmp

Download

memory/2428-9-0x000000001B660000-0x000000001B942000-memory.dmp

Download

memory/2576-1-0x00000000779C0000-0x00000000779C2000-memory.dmp

Download

memory/2576-0-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/2576-4-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/2576-2-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/2576-3-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/2576-13-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download