Analysis
-
max time kernel
147s -
max time network
276s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 01:19
Behavioral task
behavioral1
Sample
MW3_Chair.exe
Resource
win10v2004-20240508-en
General
-
Target
MW3_Chair.exe
-
Size
15.6MB
-
MD5
ce8f99f5b92137f00ef50f08d80c0dba
-
SHA1
daefb55e55e243f0734a9ccd4ecdaba9043ee505
-
SHA256
da3ac98fe7c18ae61e732c9cee9d7ed8a5808d678d4f934b3bbb434b19b2e7e4
-
SHA512
b83c9bd35dfae276d3d2940c153246c98aa2c53e4b1e77db2083e66ad4bcb63b179b1d6699e0f4cd808e201a79f2c1af36955bd1f22ef37cc830b91ef3df0e09
-
SSDEEP
393216:fyvPl1A8LtIzbhAuqTkOOqtc2BeX5N+Xy28bpa+2BIX7+k5LyCMYvK:crZtobqjkOOqq2BVXSbpaX6NRytX
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
MW3_Chair.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ MW3_Chair.exe -
Creates new service(s) 2 TTPs
-
Drops file in Drivers directory 1 IoCs
Processes:
MW3_Chair.exedescription ioc process File created C:\Windows\System32\drivers\winhb.sys MW3_Chair.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
MW3_Chair.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MW3_Chair.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MW3_Chair.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MW3_Chair.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation MW3_Chair.exe -
Processes:
resource yara_rule behavioral1/memory/4424-0-0x0000000140000000-0x0000000142290000-memory.dmp themida behavioral1/memory/4424-1-0x0000000140000000-0x0000000142290000-memory.dmp themida behavioral1/memory/4424-2-0x0000000140000000-0x0000000142290000-memory.dmp themida behavioral1/memory/4424-3-0x0000000140000000-0x0000000142290000-memory.dmp themida behavioral1/memory/4424-15-0x0000000140000000-0x0000000142290000-memory.dmp themida -
Processes:
MW3_Chair.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MW3_Chair.exe -
Drops file in System32 directory 2 IoCs
Processes:
MW3_Chair.exedescription ioc process File opened for modification C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444} MW3_Chair.exe File opened for modification C:\Windows\System32\IME\SHARED\namef.ini MW3_Chair.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
MW3_Chair.exepid process 4424 MW3_Chair.exe -
Drops file in Windows directory 1 IoCs
Processes:
MW3_Chair.exedescription ioc process File opened for modification C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE} MW3_Chair.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2064 sc.exe 368 sc.exe 680 sc.exe 2044 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
MW3_Chair.exepid process 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe 4424 MW3_Chair.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 656 -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
MW3_Chair.exedescription pid process Token: SeBackupPrivilege 4424 MW3_Chair.exe Token: SeSecurityPrivilege 4424 MW3_Chair.exe Token: SeBackupPrivilege 4424 MW3_Chair.exe Token: SeSecurityPrivilege 4424 MW3_Chair.exe Token: SeBackupPrivilege 4424 MW3_Chair.exe Token: SeSecurityPrivilege 4424 MW3_Chair.exe Token: SeBackupPrivilege 4424 MW3_Chair.exe Token: SeSecurityPrivilege 4424 MW3_Chair.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
MW3_Chair.execmd.execmd.execmd.execmd.exedescription pid process target process PID 4424 wrote to memory of 1796 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 1796 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 4436 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 4436 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 4852 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 4852 4424 MW3_Chair.exe cmd.exe PID 4436 wrote to memory of 2064 4436 cmd.exe sc.exe PID 4436 wrote to memory of 2064 4436 cmd.exe sc.exe PID 1796 wrote to memory of 2044 1796 cmd.exe sc.exe PID 1796 wrote to memory of 2044 1796 cmd.exe sc.exe PID 4424 wrote to memory of 3656 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 3656 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 2384 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 2384 4424 MW3_Chair.exe cmd.exe PID 2384 wrote to memory of 368 2384 cmd.exe sc.exe PID 2384 wrote to memory of 368 2384 cmd.exe sc.exe PID 4424 wrote to memory of 3140 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 3140 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 2180 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 2180 4424 MW3_Chair.exe cmd.exe PID 2180 wrote to memory of 680 2180 cmd.exe sc.exe PID 2180 wrote to memory of 680 2180 cmd.exe sc.exe PID 4424 wrote to memory of 2436 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 2436 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 2160 4424 MW3_Chair.exe cmd.exe PID 4424 wrote to memory of 2160 4424 MW3_Chair.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MW3_Chair.exe"C:\Users\Admin\AppData\Local\Temp\MW3_Chair.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C sc stop iqvw64e.sys2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop iqvw64e.sys3⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C sc delete iqvw64e.sys2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc delete iqvw64e.sys3⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys3⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C sc start windowsproc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc start windowsproc3⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4424-0-0x0000000140000000-0x0000000142290000-memory.dmpFilesize
34.6MB
-
memory/4424-1-0x0000000140000000-0x0000000142290000-memory.dmpFilesize
34.6MB
-
memory/4424-2-0x0000000140000000-0x0000000142290000-memory.dmpFilesize
34.6MB
-
memory/4424-3-0x0000000140000000-0x0000000142290000-memory.dmpFilesize
34.6MB
-
memory/4424-4-0x00007FF8ECCD0000-0x00007FF8ECCD2000-memory.dmpFilesize
8KB
-
memory/4424-15-0x0000000140000000-0x0000000142290000-memory.dmpFilesize
34.6MB