65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f

Analysis

max time kernel
83s
max time network
123s
platform
windows10_x64
resource
win10-en-20211208
submitted
19-12-2021 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Size

8.9MB
MD5

59f099c8c5ab999d21efdec931b40060
SHA1

337fc8dd6cab8c77aa9dfa42640bc14230fa665a
SHA256

65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f
SHA512

4dd42bf8a06258e0ffd2fa5b3eb9c6d906f80453037d8efd128abed6934ed1f3a975a791c8d4b40fbf1ed5b99897c9e1330863039adbddaaf52ca4f0d8ba6750

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2424-115-0x0000000000400000-0x0000000001C1D000-memory.dmp	themida
behavioral1/memory/2424-116-0x0000000000400000-0x0000000001C1D000-memory.dmp	themida
behavioral1/memory/2424-118-0x0000000000400000-0x0000000001C1D000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

pid process

2424 65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

pid	process
2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

description	pid	process
Token: SeDebugPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 1	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeCreateTokenPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeAssignPrimaryTokenPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeLockMemoryPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeIncreaseQuotaPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeMachineAccountPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeTcbPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeSecurityPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeTakeOwnershipPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeLoadDriverPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeSystemProfilePrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeSystemtimePrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeProfSingleProcessPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeIncBasePriorityPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeCreatePagefilePrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeCreatePermanentPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeBackupPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeRestorePrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeShutdownPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeDebugPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeAuditPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeSystemEnvironmentPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeChangeNotifyPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeRemoteShutdownPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeUndockPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeSyncAgentPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeEnableDelegationPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeManageVolumePrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeImpersonatePrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: SeCreateGlobalPrivilege	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 31	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 32	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 33	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 34	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 35	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 36	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 37	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 38	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 39	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 40	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 41	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 42	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 43	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 44	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 45	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 46	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 47	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
Token: 48	2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

pid	process
2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

pid	process
2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

pid	process
2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
2424	65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe

C:\Users\Admin\AppData\Local\Temp\65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe
"C:\Users\Admin\AppData\Local\Temp\65e6f66f1d642977aeea3ad689f91fe24496907e90f7842c5dd0ce5c2ae8a28f.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-115-0x0000000000400000-0x0000000001C1D000-memory.dmp

Filesize
24.1MB

Download
memory/2424-117-0x0000000077AD0000-0x0000000077C5E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-116-0x0000000000400000-0x0000000001C1D000-memory.dmp

Filesize
24.1MB

Download
memory/2424-118-0x0000000000400000-0x0000000001C1D000-memory.dmp

Filesize
24.1MB

Download
memory/2424-119-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-120-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-121-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-122-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-123-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-124-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-125-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-126-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-127-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-128-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-129-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-130-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-131-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-132-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-133-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-134-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-135-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-136-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-137-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-138-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-139-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-140-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-141-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-142-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-143-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-144-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-145-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-146-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-147-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-148-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-149-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-150-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-151-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-152-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-153-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-154-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-155-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-157-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-156-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-158-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-159-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-160-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-161-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-162-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-163-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-164-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-165-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-166-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-167-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-168-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-169-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-170-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-171-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-172-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-173-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-174-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-175-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-176-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-177-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-178-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-179-0x0000000000401000-0x000000000080E000-memory.dmp

Filesize
4.1MB

Download
memory/2424-535-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download
memory/2424-536-0x00000000060CD000-0x000000000620A000-memory.dmp

Filesize
1.2MB

Download
memory/2424-537-0x0000000005C10000-0x0000000005C11000-memory.dmp

Filesize
4KB

Download
memory/2424-538-0x00000000042A0000-0x00000000042A1000-memory.dmp

Filesize
4KB

Download
memory/2424-540-0x0000000005D10000-0x0000000005D11000-memory.dmp

Filesize
4KB

Download
memory/2424-539-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

Filesize
4KB

Download
memory/2424-542-0x0000000005ED0000-0x0000000005ED1000-memory.dmp

Filesize
4KB

Download
memory/2424-541-0x0000000005D30000-0x0000000005D31000-memory.dmp

Filesize
4KB

Download
memory/2424-544-0x0000000006410000-0x00000000064E1000-memory.dmp

Filesize
836KB

Download
memory/2424-543-0x0000000005EF0000-0x0000000005EF1000-memory.dmp

Filesize
4KB

Download
memory/2424-545-0x0000000006410000-0x00000000064E1000-memory.dmp

Filesize
836KB

Download