66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
138s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Downloads 12.6.24/Downloads 12.6.24/Downloads/Privacy Protector.exe
Size 8.6MB
Sample240811-3bewdaybpc
SHA256 0890f0b89e5c5745ad4bfaf1ca6459c5b765adae9cc2d0988e9456894350b434
MD5 fbf038e5ef2e30da99e88371531dfebc
SHA1 b0507491cf241aa4da8b73ef513528b2a937aa2c
SHA512 2526c6e621b64c861aa5baddd9e80d2bdd5cd7d628be115584e3f0471536ab95ef85be48ae06b5207bc70f9e6eeeb75ceebc2594ebda6b1878cbc22f8321ea84
SSDEEP 196608:gAHP6FQVWZ0C1+eqy/rRXEChq+ZExY37lJo9aM2yf/2dI:KPqWRUChqCtLlW5X2dI
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Privacy Protector.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Privacy Protector.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Privacy Protector.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Privacy Protector.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1340	4852	Privacy Protector.exe	88
PID 4852 wrote to memory of 1340	4852	Privacy Protector.exe	88
PID 1340 wrote to memory of 4832	1340	cmd.exe	89
PID 1340 wrote to memory of 4832	1340	cmd.exe	89
PID 1340 wrote to memory of 512	1340	cmd.exe	90
PID 1340 wrote to memory of 512	1340	cmd.exe	90
PID 1340 wrote to memory of 864	1340	cmd.exe	91
PID 1340 wrote to memory of 864	1340	cmd.exe	91
PID 4852 wrote to memory of 1920	4852	Privacy Protector.exe	94
PID 4852 wrote to memory of 1920	4852	Privacy Protector.exe	94

C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Privacy Protector.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Privacy Protector.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Privacy Protector.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Privacy Protector.exe" MD5
    3⤵
    PID:4832
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:512
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 05
  2⤵
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4852-0-0x0000000180000000-0x000000018001A000-memory.dmp

Download

memory/4852-7-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4852-11-0x00007FF980000000-0x00007FF980002000-memory.dmp

Download

memory/4852-12-0x0000000002050000-0x00000000020D1000-memory.dmp

Download

memory/4852-18-0x00007FF9C75F0000-0x00007FF9C75F2000-memory.dmp

Download

memory/4852-19-0x00007FF9C7550000-0x00007FF9C7745000-memory.dmp

Download

memory/4852-24-0x00007FF9C7550000-0x00007FF9C7745000-memory.dmp

Download