Analysis

  • max time kernel
    17s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-11-2024 23:43

Errors

Reason
Machine shutdown

General

  • Target

    DS BO6 CHEAT.exe

  • Size

    4.3MB

  • MD5

    a2ff3a8288ff2f7b103ff8dbeb06e3b1

  • SHA1

    c45281621cd31a61dc87a634dc0efb4f9d0f5bfa

  • SHA256

    4f6822d19005039cb0b90d9579404e4b95259de0e842bad6ea06fa3030a51b89

  • SHA512

    46a5156be8d97cba50ef7c0e239c7baffb21e310a6d777d96cc5b21c8ffea0a7716de6588643041ee31de92c9c7c5fcfc28b82ef52fd0dba066cbba89874c21b

  • SSDEEP

    98304:7p2Tv/6Q/qp7tvSDCiYfbOjLvrUKsDOUO8/YrsKt2p5Ymy1cdX9Tstd:7p2TviQepv36jUPjO8/ZKwHitd

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 11 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DS BO6 CHEAT.exe
    "C:\Users\Admin\AppData\Local\Temp\DS BO6 CHEAT.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\DS BO6 CHEAT.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\DS BO6 CHEAT.exe" MD5
        3⤵
          PID:2784
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:2904
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:2692
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c bcdedit /set hypervisorlaunchtype off >nul 2>&1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2476
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set hypervisorlaunchtype off
              3⤵
              • Modifies boot configuration data using bcdedit
              PID:2716
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            2⤵
              PID:1616
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cls
              2⤵
                PID:2832
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cls
                2⤵
                  PID:1880
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c cls
                  2⤵
                    PID:2596
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c cls
                    2⤵
                      PID:2620
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c shutdown /r /f /t 0 >nul 2>&1
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2664
                      • C:\Windows\system32\shutdown.exe
                        shutdown /r /f /t 0
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2672
                  • C:\Windows\system32\LogonUI.exe
                    "LogonUI.exe" /flags:0x0
                    1⤵
                      PID:2212
                    • C:\Windows\system32\LogonUI.exe
                      "LogonUI.exe" /flags:0x1
                      1⤵
                        PID:496

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/1736-0-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB

                      • memory/1736-1-0x00000000770C0000-0x00000000770C2000-memory.dmp

                        Filesize

                        8KB

                      • memory/1736-2-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB

                      • memory/1736-4-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB

                      • memory/1736-8-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB

                      • memory/1736-5-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB

                      • memory/1736-9-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-7-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB

                      • memory/1736-10-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-3-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB

                      • memory/1736-6-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB

                      • memory/1736-11-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-12-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-15-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-17-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-16-0x00000000770C0000-0x00000000770C2000-memory.dmp

                        Filesize

                        8KB

                      • memory/1736-14-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB

                      • memory/1736-21-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-20-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-19-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-18-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-22-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-23-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-24-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-26-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-28-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-27-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB

                      • memory/1736-29-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-30-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-32-0x0000000077070000-0x0000000077219000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/1736-31-0x000000013F910000-0x000000014032C000-memory.dmp

                        Filesize

                        10.1MB