66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads 12.6.24/Downloads 12.6.24/Downloads/Blocker v2.exe
Size

12.4MB
MD5

a9c090dde54cb5f996b3e15da5fe3b08
SHA1

e799961d2a957c2b84dc6ff32e73c5cabe45a395
SHA256

deae15597f320e6c3b7b655947a6ef9459027790d452f5e1f2559b15ce50a2df
SHA512

21e1a2d4e14399ecf3e5d085d0017b756ba8821708c8d5601c718fea356af1b701e60d2d61d8cdaabd7e962975d5bf230e6d421ac1e620556e3d8c605e1f87d8
SSDEEP

393216:6Pyeiimo7NiqXDCzcQ9Lnp/4ygyeF53i4F2CucQOuons:T9imoMMS1/pgyeFNiS2CEp

Score

9^/10

evasion execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Blocker v2.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Blocker v2.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Blocker v2.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Blocker v2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Blocker v2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Blocker v2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Blocker v2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Blocker v2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Blocker v2.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Blocker v2.exe
Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

Power Settings
T1653

Processes:

powercfg.execmd.exe

pid process

1128 powercfg.exe
4876 cmd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Blocker v2.exe

pid	process
1128	powercfg.exe
4876	cmd.exe

Drops file in System32 directory 6 IoCs

Processes:

Blocker v2.exe

description	ioc	process
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2869}	Blocker v2.exe
File opened for modification	C:\Windows\System32\IME\IMETC\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2899}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	Blocker v2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Blocker v2.exe

pid process

4012 Blocker v2.exe

pid	process
4012	Blocker v2.exe

Drops file in Windows directory 4 IoCs

Processes:

Blocker v2.exe

description	ioc	process
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2893}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2892}	Blocker v2.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3152 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3152	sc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeBlocker v2.exe

pid	process
2032	powershell.exe
2032	powershell.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powercfg.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	1128	powercfg.exe
Token: SeCreatePagefilePrivilege	1128	powercfg.exe
Token: SeShutdownPrivilege	1128	powercfg.exe
Token: SeCreatePagefilePrivilege	1128	powercfg.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeSystemEnvironmentPrivilege	2032	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Blocker v2.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4012 wrote to memory of 4876	4012	Blocker v2.exe	cmd.exe
PID 4012 wrote to memory of 4876	4012	Blocker v2.exe	cmd.exe
PID 4012 wrote to memory of 1000	4012	Blocker v2.exe	cmd.exe
PID 4012 wrote to memory of 1000	4012	Blocker v2.exe	cmd.exe
PID 1000 wrote to memory of 2032	1000	cmd.exe	powershell.exe
PID 1000 wrote to memory of 2032	1000	cmd.exe	powershell.exe
PID 4876 wrote to memory of 1128	4876	cmd.exe	powercfg.exe
PID 4876 wrote to memory of 1128	4876	cmd.exe	powercfg.exe
PID 4012 wrote to memory of 4584	4012	Blocker v2.exe	cmd.exe
PID 4012 wrote to memory of 4584	4012	Blocker v2.exe	cmd.exe
PID 4012 wrote to memory of 5108	4012	Blocker v2.exe	cmd.exe
PID 4012 wrote to memory of 5108	4012	Blocker v2.exe	cmd.exe
PID 4012 wrote to memory of 1628	4012	Blocker v2.exe	cmd.exe
PID 4012 wrote to memory of 1628	4012	Blocker v2.exe	cmd.exe
PID 4012 wrote to memory of 4056	4012	Blocker v2.exe	cmd.exe
PID 4012 wrote to memory of 4056	4012	Blocker v2.exe	cmd.exe
PID 4056 wrote to memory of 3152	4056	cmd.exe	sc.exe
PID 4056 wrote to memory of 3152	4056	cmd.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Blocker v2.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Blocker v2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C Powercfg -h off
2⤵
- Power Settings
- Suspicious use of WriteProcessMemory
PID:4876

C:\Windows\system32\powercfg.exe
Powercfg -h off
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell "Confirm-SecureBootUEFI" > C:\secureboot_status.txt
2⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "Confirm-SecureBootUEFI"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:4584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:5108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:1628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc delete windowsproc
2⤵
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\system32\sc.exe
sc delete windowsproc
3⤵
- Launches sc.exe
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cm1jqnwg.hf0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\secureboot_status.txt

Filesize
420B

MD5
de582b589ac295c03fcf52ca102a28c0

SHA1
10cc2b1adb41e11abb33383ab102ff204379afa4

SHA256
86aea26372f98f717f138713881a44bdb3b9ac666f70328398ceea2ae15d3c1f

SHA512
af023664d90c322d6d2c4cd2988e6a5eb23e4506bec588b9247a4e9f11baf0f21c9941e6dde5e3440719ceb2d2c154c6f853d5082a0f2b7c22c8a50fed0cc81d

Download Submit
memory/2032-10-0x0000019AF5310000-0x0000019AF5332000-memory.dmp

Filesize
136KB

Download
memory/4012-2-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/4012-3-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/4012-0-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/4012-4-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/4012-1-0x00007FFE89830000-0x00007FFE89832000-memory.dmp

Filesize
8KB

Download
memory/4012-26-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/4012-27-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/4012-28-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/4012-29-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/4012-30-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/4012-31-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download
memory/4012-32-0x0000000140000000-0x0000000141BEF000-memory.dmp

Filesize
27.9MB

Download