Analysis
- max time kernel
95s - max time network
94s - platform
windows7_x64 - resource
win7v20201028 - submitted
26/03/2021, 17:32
General
- Target aInjector Win64_x32.exe
- Size 4.2MB
- Sample210326-4eazsm9776
- SHA256 09feb423dd354f1e64a957b130e47f38d07d6be37e71c43a17742f32fa73ff6a
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- themida 1 IoCs
Detects Themida, Advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aInjector Win64_x32.exe"C:\Users\Admin\AppData\Local\Temp\aInjector Win64_x32.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1020-2-0x00000000753E1000-0x00000000753E3000-memory.dmp
memory/1020-4-0x0000000073F40000-0x000000007462E000-memory.dmp
memory/1020-5-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/1020-7-0x0000000000E90000-0x0000000000EDE000-memory.dmp
memory/1020-8-0x0000000000C30000-0x0000000000C31000-memory.dmp
memory/1020-9-0x00000000054D0000-0x00000000054D1000-memory.dmp