66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Downloads 12.6.24/Downloads 12.6.24/Downloads/Blocker v2.exe
Size 12.4MB
Sample240811-3bewdaybpc
SHA256 deae15597f320e6c3b7b655947a6ef9459027790d452f5e1f2559b15ce50a2df
MD5 a9c090dde54cb5f996b3e15da5fe3b08
SHA1 e799961d2a957c2b84dc6ff32e73c5cabe45a395
SHA512 21e1a2d4e14399ecf3e5d085d0017b756ba8821708c8d5601c718fea356af1b701e60d2d61d8cdaabd7e962975d5bf230e6d421ac1e620556e3d8c605e1f87d8
SSDEEP 393216:6Pyeiimo7NiqXDCzcQ9Lnp/4ygyeF53i4F2CucQOuons:T9imoMMS1/pgyeFNiS2CEp
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Blocker v2.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Blocker v2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Blocker v2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Blocker v2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Blocker v2.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1128	powercfg.exe
4876	cmd.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2869}	Blocker v2.exe
File opened for modification	C:\Windows\System32\IME\IMETC\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2899}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444}	Blocker v2.exe
File opened for modification	C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2879}	Blocker v2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4012	Blocker v2.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2859}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2893}	Blocker v2.exe
File opened for modification	C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-1B70783F2892}	Blocker v2.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3152	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2032	powershell.exe
2032	powershell.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe
4012	Blocker v2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1128	powercfg.exe
Token: SeCreatePagefilePrivilege	1128	powercfg.exe
Token: SeShutdownPrivilege	1128	powercfg.exe
Token: SeCreatePagefilePrivilege	1128	powercfg.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeSystemEnvironmentPrivilege	2032	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4876	4012	Blocker v2.exe	86
PID 4012 wrote to memory of 4876	4012	Blocker v2.exe	86
PID 4012 wrote to memory of 1000	4012	Blocker v2.exe	87
PID 4012 wrote to memory of 1000	4012	Blocker v2.exe	87
PID 1000 wrote to memory of 2032	1000	cmd.exe	89
PID 1000 wrote to memory of 2032	1000	cmd.exe	89
PID 4876 wrote to memory of 1128	4876	cmd.exe	90
PID 4876 wrote to memory of 1128	4876	cmd.exe	90
PID 4012 wrote to memory of 4584	4012	Blocker v2.exe	91
PID 4012 wrote to memory of 4584	4012	Blocker v2.exe	91
PID 4012 wrote to memory of 5108	4012	Blocker v2.exe	96
PID 4012 wrote to memory of 5108	4012	Blocker v2.exe	96
PID 4012 wrote to memory of 1628	4012	Blocker v2.exe	97
PID 4012 wrote to memory of 1628	4012	Blocker v2.exe	97
PID 4012 wrote to memory of 4056	4012	Blocker v2.exe	105
PID 4012 wrote to memory of 4056	4012	Blocker v2.exe	105
PID 4056 wrote to memory of 3152	4056	cmd.exe	107
PID 4056 wrote to memory of 3152	4056	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Blocker v2.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Blocker v2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C Powercfg -h off
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\system32\powercfg.exe
    Powercfg -h off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Confirm-SecureBootUEFI" > C:\secureboot_status.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Confirm-SecureBootUEFI"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc delete windowsproc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\system32\sc.exe
    sc delete windowsproc
    3⤵
    - Launches sc.exe
    PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_cm1jqnwg.hf0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cm1jqnwg.hf0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

secureboot_status.txt

Path C:\secureboot_status.txt
Size 420B
SHA256 86aea26372f98f717f138713881a44bdb3b9ac666f70328398ceea2ae15d3c1f
MD5 de582b589ac295c03fcf52ca102a28c0
SHA1 10cc2b1adb41e11abb33383ab102ff204379afa4
SHA512 af023664d90c322d6d2c4cd2988e6a5eb23e4506bec588b9247a4e9f11baf0f21c9941e6dde5e3440719ceb2d2c154c6f853d5082a0f2b7c22c8a50fed0cc81d
MD5 SHA1 SHA512

Submit Download

memory/2032-10-0x0000019AF5310000-0x0000019AF5332000-memory.dmp

Download

memory/4012-2-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/4012-3-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/4012-0-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/4012-4-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/4012-1-0x00007FFE89830000-0x00007FFE89832000-memory.dmp

Download

memory/4012-26-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/4012-27-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/4012-28-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/4012-29-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/4012-30-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/4012-31-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download

memory/4012-32-0x0000000140000000-0x0000000141BEF000-memory.dmp

Download