Overview

overview

10

Static

static

8 Cores.msi

windows7_x64

6

8 Cores.msi

windows10_x64

10

8 Cores.msi

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8 Cores.msi

  • Size

    319KB

  • Sample

    220116-wnja1afha2

  • MD5

    6047ee1af2d30ef7db95fabb788ec9f9

  • SHA1

    2731a77f03f97aa03adcd2c7c6f4342d2fd1d515

  • SHA256

    b3f5506d672e2ea0564c52413f1f8847c569542d2cd475937c6f21a443292728

  • SHA512

    7d8de10cdf4399692da6b7e80c96d865ffc891292e1bf16adaf663f2cf087802ae61bde15057a9aa7c82d6dbd0930e623c3a4c947502c5c1129bbc66d8aa03e8

Score
10/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      8 Cores.msi

    • Size

      319KB

    • MD5

      6047ee1af2d30ef7db95fabb788ec9f9

    • SHA1

      2731a77f03f97aa03adcd2c7c6f4342d2fd1d515

    • SHA256

      b3f5506d672e2ea0564c52413f1f8847c569542d2cd475937c6f21a443292728

    • SHA512

      7d8de10cdf4399692da6b7e80c96d865ffc891292e1bf16adaf663f2cf087802ae61bde15057a9aa7c82d6dbd0930e623c3a4c947502c5c1129bbc66d8aa03e8

    Score
    10/10
    persistenceevasionthemidatrojan

    • Registers COM server for autorun

      persistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

7
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

8
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks