4ddaa14f57744b2cac875ffb15a09e49246b9a45ab3c1122dca7aa47f820a1f2

Analysis

max time kernel
140s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GlassWire.exe
Size

11.4MB
MD5

0cdf65d9e3da8dcf541ac718aa4cac26
SHA1

5cd8aa79429ceee076d9f38b56863550ac3be478
SHA256

18bb786859c67faa73a71f305784a33e062445b1ba5e7114ce1f5f3d924fe766
SHA512

e3d87710594f835fc6b4ebbcc06263b4a91340cf55c0c909e62f66c712b86aefb91bd9c9b8f9985a518b7e06345cbc3bc4315562f7bb2c2ad0a15b5439e99701
SSDEEP

196608:F2S9fwxgol7RKTnh/lxJBjvy9xM0uI6HGWnB7LlyjC2g1ZH2cP:F2qCN4TdlxHjv62RfB7hoCLZW6

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

GlassWire.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ GlassWire.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GlassWire.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GlassWire.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GlassWire.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GlassWire.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

GlassWire.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GlassWire.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

GlassWire.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation GlassWire.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

GlassWire.exe

pid process

5044 GlassWire.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

GlassWire.exe

pid process

5044 GlassWire.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

GlassWire.exe

pid process

5044 GlassWire.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GlassWire.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	GlassWire.exe

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

GlassWire.exe

pid	process
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe
5044	GlassWire.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

GlassWire.exe

pid process

5044 GlassWire.exe
5044 GlassWire.exe
5044 GlassWire.exe
5044 GlassWire.exe
5044 GlassWire.exe
5044 GlassWire.exe
5044 GlassWire.exe
5044 GlassWire.exe
5044 GlassWire.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

GlassWire.exe

pid process

5044 GlassWire.exe

C:\Users\Admin\AppData\Local\Temp\GlassWire.exe
"C:\Users\Admin\AppData\Local\Temp\GlassWire.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5044

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5044-0-0x0000000077434000-0x0000000077436000-memory.dmp

Filesize
8KB

Download
memory/5044-1-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-2-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-3-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-4-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-5-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-6-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-7-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-8-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-9-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-10-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-11-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-12-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-14-0x0000000002E80000-0x0000000002E90000-memory.dmp

Filesize
64KB

Download
memory/5044-13-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-16-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-18-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-19-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-20-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-21-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download
memory/5044-23-0x0000000000760000-0x0000000002845000-memory.dmp

Filesize
32.9MB

Download