a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b

General

Target

a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe
Size

2.5MB
MD5

a1f11a6043e639a2efc7b229a04be7e5
SHA1

ec81bf43d8bcf36061a60f7ea4bd8b3a2337a251
SHA256

a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b
SHA512

fd8e8aecb53cdf74f5587452de8dfaea3438374aca95964d7939f9d9b96412b844044991663ad5e8079453cf11bbadd927e0cf12d366a7c36d2a6df8d4391b91

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

13 1492 WScript.exe
14 1492 WScript.exe
15 1492 WScript.exe
16 1492 WScript.exe

flow	pid	process
13	1492	WScript.exe
14	1492	WScript.exe
15	1492	WScript.exe
16	1492	WScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/288-54-0x0000000000290000-0x0000000000911000-memory.dmp	themida
behavioral1/memory/288-55-0x0000000000290000-0x0000000000911000-memory.dmp	themida
behavioral1/memory/288-57-0x0000000000290000-0x0000000000911000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

pid process

288 a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
4	ip-api.com

pid	process
288	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

pid process

288 a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

pid	process
288	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe

description	pid	process	target process
PID 288 wrote to memory of 1540	288	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe	WScript.exe
PID 288 wrote to memory of 1540	288	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe	WScript.exe
PID 288 wrote to memory of 1540	288	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe	WScript.exe
PID 288 wrote to memory of 1540	288	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe	WScript.exe
PID 288 wrote to memory of 1492	288	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe	WScript.exe
PID 288 wrote to memory of 1492	288	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe	WScript.exe
PID 288 wrote to memory of 1492	288	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe	WScript.exe
PID 288 wrote to memory of 1492	288	a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe
"C:\Users\Admin\AppData\Local\Temp\a32a8a73376011de007c1fff66b6f5535a60df9ab22cbfaafc90784765f11e1b.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ekwtermxx.vbs"
2⤵
PID:1540

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cvskbfqg.vbs"
2⤵
- Blocklisted process makes network request
PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cvskbfqg.vbs
MD5
25e9ab337f63cd7718cbc9ed57961a3a

SHA1
ececa9adafd09211282ad2fbeeb76f881a9755c7

SHA256
b38518428ad29f9fc428c7bb6858c4f1b9189ced663031250a4499845e6e25b1

SHA512
7e67b57c7b5a28a9005fba42f55cb0725c11d0e9636356b29a256ebaa4cac9335c6876a8777225f1158ef2ef9198d36a63289870300f8ea177be0d35c4ee2469

Download Submit
C:\Users\Admin\AppData\Local\Temp\ekwtermxx.vbs
MD5
826bc794f35ba4e9aa505405c67cfc29

SHA1
9c89d35bcbf8a0ae3a21e3e8a1108998f5175e83

SHA256
f53f4a39a894af929abe6d84b574aca13ec19f7eb2a738d9c6324815d5b955ff

SHA512
6e6e8f0fd1c2c3252ac1cdf167fb890dc5d0ed4e96853fcced8c8c752b085bae85e434aae27f9211246fa390ba8ec0c894ac36edc9547d4f8075824ad00d0a12

Download Submit
memory/288-53-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/288-54-0x0000000000290000-0x0000000000911000-memory.dmp

Filesize
6.5MB

Download
memory/288-55-0x0000000000290000-0x0000000000911000-memory.dmp

Filesize
6.5MB

Download
memory/288-56-0x0000000077850000-0x0000000077852000-memory.dmp

Filesize
8KB

Download
memory/288-57-0x0000000000290000-0x0000000000911000-memory.dmp

Filesize
6.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads