Overview

overview

10

Static

static

8

File.exe

windows7_x64

10

File.exe

windows10-2004_x64

9

Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-06-2022 17:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    File.exe

  • Size

    4.8MB

  • MD5

    c38b1f5087b560432a9e4d401c9c7c7b

  • SHA1

    7bd99ddd2e3b5836317d04c506f1cc89a5f90436

  • SHA256

    f072f7896731668ac389aa1d7da8c1d12a858bcf58b6ef8d023ffa78ef3f4023

  • SHA512

    f09ed2df81cedf1767c5479f7a4f4c322e8c050b4ab5ccbbb8eb8ba87bcc188d67a7cb78a3c6c9a957d6bd1b9f8d9377e43b06ed464408faf3dce95a8a5c585a

Score
9/10
evasionthemidatrojanvmprotect

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • VMProtect packed file 6 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\File.exe
    "C:\Users\Admin\AppData\Local\Temp\File.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3980-130-0x00000000003F0000-0x0000000000BCF000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3980-131-0x00000000003F0000-0x0000000000BCF000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3980-132-0x00000000003F0000-0x0000000000BCF000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3980-133-0x00000000003F0000-0x0000000000BCF000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3980-134-0x0000000077220000-0x00000000773C3000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3980-135-0x00000000003F0000-0x0000000000BCF000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3980-136-0x0000000077220000-0x00000000773C3000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3980-137-0x00000000003F0000-0x0000000000BCF000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3980-138-0x0000000077220000-0x00000000773C3000-memory.dmp
    Filesize

    1.6MB

    Download