MachineHunter / SafeExecute

自分で設定したセキュリティのルールの下、実行ファイルを安全に実行できるツールです。
3 stars 0 forks source link

Detect OpenProcessToken and AdjustTokenPrivileges #76

Closed shhu6844 closed 2 years ago

shhu6844 commented 2 years ago

Raccoon Stealer v2 used OpenProcessToken and AdjustTokenPrivileges to detect if malware is running as SYSTEM or not, which is an interesting point to observe! In Raccoon Stealer v2, the Windows APIs OpenProcessToken is not the main method of their exploit but a programming logic to decide which functionality of their malware should continue. However, it seems that it's not common for many programs or executables to use these two APIs. In my opinion, it may be a suspicious point if some program use these APIs, especially the ones you already doubt it. Here is the Source.