66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads 12.6.24/Downloads 12.6.24/Downloads/Blocker v2.exe
Size

12.4MB
MD5

a9c090dde54cb5f996b3e15da5fe3b08
SHA1

e799961d2a957c2b84dc6ff32e73c5cabe45a395
SHA256

deae15597f320e6c3b7b655947a6ef9459027790d452f5e1f2559b15ce50a2df
SHA512

21e1a2d4e14399ecf3e5d085d0017b756ba8821708c8d5601c718fea356af1b701e60d2d61d8cdaabd7e962975d5bf230e6d421ac1e620556e3d8c605e1f87d8
SSDEEP

393216:6Pyeiimo7NiqXDCzcQ9Lnp/4ygyeF53i4F2CucQOuons:T9imoMMS1/pgyeFNiS2CEp

Score

9^/10

evasion execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Blocker v2.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Blocker v2.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Blocker v2.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Blocker v2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Blocker v2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Blocker v2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Blocker v2.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Blocker v2.exe
Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

Power Settings
T1653

Processes:

powercfg.execmd.exe

pid process

1696 powercfg.exe
2004 cmd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Blocker v2.exe

pid	process
1696	powercfg.exe
2004	cmd.exe

Drops file in System32 directory 6 IoCs

Processes:

Blocker v2.exe

description	ioc	process
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2869}	Blocker v2.exe
File opened for modification	C:\Windows\System32\IME\IMETC\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2899}	Blocker v2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Blocker v2.exe

pid process

2576 Blocker v2.exe

pid	process
2576	Blocker v2.exe

Drops file in Windows directory 4 IoCs

Processes:

Blocker v2.exe

description	ioc	process
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2892}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2893}	Blocker v2.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2752 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2752	sc.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

powershell.exeBlocker v2.exe

pid	process
2428	powershell.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe
2576	Blocker v2.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powercfg.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	1696	powercfg.exe
Token: SeShutdownPrivilege	1696	powercfg.exe
Token: SeShutdownPrivilege	1696	powercfg.exe
Token: SeShutdownPrivilege	1696	powercfg.exe
Token: SeShutdownPrivilege	1696	powercfg.exe
Token: SeCreatePagefilePrivilege	1696	powercfg.exe
Token: SeDebugPrivilege	2428	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

Blocker v2.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2576 wrote to memory of 2004	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2004	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2004	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 1396	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 1396	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 1396	2576	Blocker v2.exe	cmd.exe
PID 1396 wrote to memory of 2428	1396	cmd.exe	powershell.exe
PID 1396 wrote to memory of 2428	1396	cmd.exe	powershell.exe
PID 1396 wrote to memory of 2428	1396	cmd.exe	powershell.exe
PID 2004 wrote to memory of 1696	2004	cmd.exe	powercfg.exe
PID 2004 wrote to memory of 1696	2004	cmd.exe	powercfg.exe
PID 2004 wrote to memory of 1696	2004	cmd.exe	powercfg.exe
PID 2576 wrote to memory of 2868	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2868	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2868	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2888	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2888	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2888	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2904	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2904	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2904	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2872	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2872	2576	Blocker v2.exe	cmd.exe
PID 2576 wrote to memory of 2872	2576	Blocker v2.exe	cmd.exe
PID 2872 wrote to memory of 2752	2872	cmd.exe	sc.exe
PID 2872 wrote to memory of 2752	2872	cmd.exe	sc.exe
PID 2872 wrote to memory of 2752	2872	cmd.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Blocker v2.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Blocker v2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C Powercfg -h off
2⤵
- Power Settings
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\system32\powercfg.exe
Powercfg -h off
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell "Confirm-SecureBootUEFI" > C:\secureboot_status.txt
2⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "Confirm-SecureBootUEFI"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:2868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:2888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:2904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc delete windowsproc
2⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\system32\sc.exe
sc delete windowsproc
3⤵
- Launches sc.exe
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\secureboot_status.txt

Filesize
447B

MD5
cf8355d29a9d97cf5d6a673e64f9fcda

SHA1
9050f2dd8c50258f22fea4278268357d4133668f

SHA256
7fc3a10f21c5405061e1eff734790d1a640ddc1971a84e60070288af8bb161d3

SHA512
9669cb9c7100047e4f0c0478edc3c390fde9fa8ae98e5aaf4c204520f6eb3e57c11eb388f72986afd21781c24b2796c39e1aa291d34f481b0de9c94b81bd1a48

Download Submit
memory/2428-10-0x00000000026E0000-0x00000000026E8000-memory.dmp

Filesize
32KB

Download
memory/2428-9-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2576-1-0x00000000779C0000-0x00000000779C2000-memory.dmp

Filesize
8KB

Download
memory/2576-0-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/2576-4-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/2576-2-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/2576-3-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/2576-13-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download