da6ce92ec5c7305011dbfa5a6d4b81c43794eba55652744729744b4980e2b0c2

General

Target

fg797p.exe
Size

7.1MB
MD5

98042f03baf3cad4dc4ab8e882063e14
SHA1

87d47f67b8d4b021f19d1c1d8514453facca2be6
SHA256

da6ce92ec5c7305011dbfa5a6d4b81c43794eba55652744729744b4980e2b0c2
SHA512

7ddd8b95e58bf01f588f93d9864d90b65b4af7035b9f4c68dc93690c1a312193263a9a839ddeaead6f155548f3530569d0af3178d9b6c20c317b06f06e210377

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

fg797p.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fg797p.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fg797p.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fg797p.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fg797p.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fg797p.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1412-55-0x0000000000400000-0x00000000015B9000-memory.dmp	themida
behavioral1/memory/1412-56-0x0000000000400000-0x00000000015B9000-memory.dmp	themida
behavioral1/memory/1412-58-0x0000000000400000-0x00000000015B9000-memory.dmp	themida
behavioral1/memory/1412-59-0x0000000000400000-0x00000000015B9000-memory.dmp	themida
behavioral1/memory/1412-60-0x0000000000400000-0x00000000015B9000-memory.dmp	themida
behavioral1/memory/1412-61-0x0000000000400000-0x00000000015B9000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

fg797p.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fg797p.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

fg797p.exe

pid process

1412 fg797p.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fg797p.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8EBA701-11E4-11ED-BFBD-DAA838F30046} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fg797p.exe

pid process

1412 fg797p.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1552 iexplore.exe

pid	process
1552	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

fg797p.exeiexplore.exeIEXPLORE.EXE

pid	process
1412	fg797p.exe
1412	fg797p.exe
1412	fg797p.exe
1412	fg797p.exe
1412	fg797p.exe
1552	iexplore.exe
1552	iexplore.exe
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fg797p.exeiexplore.exe

description	pid	process	target process
PID 1412 wrote to memory of 1552	1412	fg797p.exe	iexplore.exe
PID 1412 wrote to memory of 1552	1412	fg797p.exe	iexplore.exe
PID 1412 wrote to memory of 1552	1412	fg797p.exe	iexplore.exe
PID 1412 wrote to memory of 1552	1412	fg797p.exe	iexplore.exe
PID 1552 wrote to memory of 1948	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 1948	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 1948	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 1948	1552	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\fg797p.exe
"C:\Users\Admin\AppData\Local\Temp\fg797p.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://dongtaiwang.com/loc/phome.php?v=7.97p&l=409
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\35bgd18\imagestore.dat
Filesize
5KB

MD5
67d9ac98faa94c32fd4119b651075118

SHA1
5eebaf56444853c81d92dd463bc4e401be9b90ad

SHA256
d4b396aa8edc60f0dca28041b3194e8484315f90d210187c8459b0cd456f1263

SHA512
375e959b3407de63f83aa2ea96faf1d77f2890561f243719704b7cf724dae7974c9a4c33b036a572ba7016b629578ee4fd39450356bda63953cf32ba2cf89831

Download Submit
memory/1412-54-0x0000000076291000-0x0000000076293000-memory.dmp

Filesize
8KB

Download
memory/1412-55-0x0000000000400000-0x00000000015B9000-memory.dmp

Filesize
17.7MB

Download
memory/1412-56-0x0000000000400000-0x00000000015B9000-memory.dmp

Filesize
17.7MB

Download
memory/1412-57-0x0000000077670000-0x00000000777F0000-memory.dmp

Filesize
1.5MB

Download
memory/1412-58-0x0000000000400000-0x00000000015B9000-memory.dmp

Filesize
17.7MB

Download
memory/1412-59-0x0000000000400000-0x00000000015B9000-memory.dmp

Filesize
17.7MB

Download
memory/1412-60-0x0000000000400000-0x00000000015B9000-memory.dmp

Filesize
17.7MB

Download
memory/1412-61-0x0000000000400000-0x00000000015B9000-memory.dmp

Filesize
17.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads