66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
138s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads 12.6.24/Downloads 12.6.24/Downloads/Privacy Protector.exe
Size

8.6MB
MD5

fbf038e5ef2e30da99e88371531dfebc
SHA1

b0507491cf241aa4da8b73ef513528b2a937aa2c
SHA256

0890f0b89e5c5745ad4bfaf1ca6459c5b765adae9cc2d0988e9456894350b434
SHA512

2526c6e621b64c861aa5baddd9e80d2bdd5cd7d628be115584e3f0471536ab95ef85be48ae06b5207bc70f9e6eeeb75ceebc2594ebda6b1878cbc22f8321ea84
SSDEEP

196608:gAHP6FQVWZ0C1+eqy/rRXEChq+ZExY37lJo9aM2yf/2dI:KPqWRUChqCtLlW5X2dI

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Privacy Protector.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Privacy Protector.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Privacy Protector.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Privacy Protector.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Privacy Protector.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Privacy Protector.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Privacy Protector.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Privacy Protector.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

Privacy Protector.exe

pid process

4852 Privacy Protector.exe
4852 Privacy Protector.exe
4852 Privacy Protector.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Privacy Protector.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Privacy Protector.exe

pid	process
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe
4852	Privacy Protector.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Privacy Protector.execmd.exe

description	pid	process	target process
PID 4852 wrote to memory of 1340	4852	Privacy Protector.exe	cmd.exe
PID 4852 wrote to memory of 1340	4852	Privacy Protector.exe	cmd.exe
PID 1340 wrote to memory of 4832	1340	cmd.exe	certutil.exe
PID 1340 wrote to memory of 4832	1340	cmd.exe	certutil.exe
PID 1340 wrote to memory of 512	1340	cmd.exe	find.exe
PID 1340 wrote to memory of 512	1340	cmd.exe	find.exe
PID 1340 wrote to memory of 864	1340	cmd.exe	find.exe
PID 1340 wrote to memory of 864	1340	cmd.exe	find.exe
PID 4852 wrote to memory of 1920	4852	Privacy Protector.exe	cmd.exe
PID 4852 wrote to memory of 1920	4852	Privacy Protector.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Privacy Protector.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Privacy Protector.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Privacy Protector.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Privacy Protector.exe" MD5
3⤵
PID:4832

C:\Windows\system32\find.exe
find /i /v "md5"
3⤵
PID:512

C:\Windows\system32\find.exe
find /i /v "certutil"
3⤵
PID:864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Color 05
2⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4852-0-0x0000000180000000-0x000000018001A000-memory.dmp

Filesize
104KB

Download
memory/4852-7-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/4852-11-0x00007FF980000000-0x00007FF980002000-memory.dmp

Filesize
8KB

Download
memory/4852-12-0x0000000002050000-0x00000000020D1000-memory.dmp

Filesize
516KB

Download
memory/4852-18-0x00007FF9C75F0000-0x00007FF9C75F2000-memory.dmp

Filesize
8KB

Download
memory/4852-19-0x00007FF9C7550000-0x00007FF9C7745000-memory.dmp

Filesize
2.0MB

Download
memory/4852-24-0x00007FF9C7550000-0x00007FF9C7745000-memory.dmp

Filesize
2.0MB

Download