6cc29cdedf05f72a8d76db224f5f2e52dc97a1167d09534ae2efc3e7d4480263 | Triage

Submit
Reports

Overview

overview

9

Static

static

7

winprofile

windows7-x64

9

winprofile

windows10-1703-x64

9

Sharing

General

Target

6cc29cdedf05f72a8d76db224f5f2e52dc97a1167d09534ae2efc3e7d4480263
Size

1.6MB
Sample

220720-erznqabff4
MD5

360928b5a21ce5408ef820d177082383
SHA1

073a039904bfd45bc756eadfcc586307f3c4bccc
SHA256

6cc29cdedf05f72a8d76db224f5f2e52dc97a1167d09534ae2efc3e7d4480263
SHA512

27b6b36b28c05f31ac70a1ca0c9392b143a27d2d2887a2ef2f10f4014fe8e98877fb18a66d9b7beb382febe50bec566f05d8c47b171d8686d561d1c594f2b150

Score

9^/10

evasion persistence themida trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

6cc29cdedf05f72a8d76db224f5f2e52dc97a1167d09534ae2efc3e7d4480263.exe

Resource

win7-20220718-en

evasion persistence themida trojan

windows7-x64

7 signatures

300 seconds

Behavioral task

behavioral2

Sample

6cc29cdedf05f72a8d76db224f5f2e52dc97a1167d09534ae2efc3e7d4480263.exe

Resource

win10-20220414-en

evasion persistence themida trojan

windows10-1703-x64

7 signatures

300 seconds

Malware Config

Targets

- Target
  
  6cc29cdedf05f72a8d76db224f5f2e52dc97a1167d09534ae2efc3e7d4480263
- Size
  
  1.6MB
- MD5
  
  360928b5a21ce5408ef820d177082383
- SHA1
  
  073a039904bfd45bc756eadfcc586307f3c4bccc
- SHA256
  
  6cc29cdedf05f72a8d76db224f5f2e52dc97a1167d09534ae2efc3e7d4480263
- SHA512
  
  27b6b36b28c05f31ac70a1ca0c9392b143a27d2d2887a2ef2f10f4014fe8e98877fb18a66d9b7beb382febe50bec566f05d8c47b171d8686d561d1c594f2b150
Score

9^/10

evasion persistence themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencethemidatrojan

behavioral2

evasionpersistencethemidatrojan

© 2018-2024

Terms | Privacy