Analysis

  • max time kernel
    22s
  • max time network
    26s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 23:43

Errors

Reason
Machine shutdown

General

  • Target

    DS BO6 CHEAT.exe

  • Size

    4.3MB

  • MD5

    a2ff3a8288ff2f7b103ff8dbeb06e3b1

  • SHA1

    c45281621cd31a61dc87a634dc0efb4f9d0f5bfa

  • SHA256

    4f6822d19005039cb0b90d9579404e4b95259de0e842bad6ea06fa3030a51b89

  • SHA512

    46a5156be8d97cba50ef7c0e239c7baffb21e310a6d777d96cc5b21c8ffea0a7716de6588643041ee31de92c9c7c5fcfc28b82ef52fd0dba066cbba89874c21b

  • SSDEEP

    98304:7p2Tv/6Q/qp7tvSDCiYfbOjLvrUKsDOUO8/YrsKt2p5Ymy1cdX9Tstd:7p2TviQepv36jUPjO8/ZKwHitd

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
  • Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

    Disable Windows Driver Blocklist via Registry.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 11 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DS BO6 CHEAT.exe
    "C:\Users\Admin\AppData\Local\Temp\DS BO6 CHEAT.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Modify Registry: Disable Windows Driver Blocklist
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\DS BO6 CHEAT.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\DS BO6 CHEAT.exe" MD5
        3⤵
          PID:4996
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:4592
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:1536
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c bcdedit /set hypervisorlaunchtype off >nul 2>&1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3816
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set hypervisorlaunchtype off
              3⤵
              • Modifies boot configuration data using bcdedit
              PID:764
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            2⤵
              PID:4132
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cls
              2⤵
                PID:384
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cls
                2⤵
                  PID:1828
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c cls
                  2⤵
                    PID:3552
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c cls
                    2⤵
                      PID:3708
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c shutdown /r /f /t 0 >nul 2>&1
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1340
                      • C:\Windows\system32\shutdown.exe
                        shutdown /r /f /t 0
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4932
                  • C:\Windows\system32\LogonUI.exe
                    "LogonUI.exe" /flags:0x4 /state0:0xa38cf855 /state1:0x41c64e6d
                    1⤵
                    • Modifies data under HKEY_USERS
                    • Suspicious use of SetWindowsHookEx
                    PID:3948

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/4636-0-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB

                  • memory/4636-1-0x00007FFE8BCD0000-0x00007FFE8BCD2000-memory.dmp

                    Filesize

                    8KB

                  • memory/4636-4-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB

                  • memory/4636-3-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB

                  • memory/4636-2-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB

                  • memory/4636-6-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB

                  • memory/4636-7-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB

                  • memory/4636-8-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB

                  • memory/4636-5-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB

                  • memory/4636-9-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-10-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-11-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-12-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-14-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-13-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB

                  • memory/4636-17-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-16-0x00007FFE8BCD0000-0x00007FFE8BCD2000-memory.dmp

                    Filesize

                    8KB

                  • memory/4636-18-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-19-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-21-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-22-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-20-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-23-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-25-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-27-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-26-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-28-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-29-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-24-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-30-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-31-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB

                  • memory/4636-32-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-34-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-35-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-36-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-37-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-38-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-39-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-40-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-43-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4636-42-0x00007FF6B1240000-0x00007FF6B1C5C000-memory.dmp

                    Filesize

                    10.1MB