Overview

overview

10

Static

static

7

fdvs.exe

windows7-x64

10

fdvs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fdvs.exe

  • Size

    7.4MB

  • Sample

    220907-f7s2jsbbc4

  • MD5

    84ce5fd0128b726ac96fe36b2487f2cb

  • SHA1

    85d72d2107bfada76b93b87aac159434feb5655b

  • SHA256

    4e26769763d85b15d722bf3257809ebaf7248b6b05aaaf38312ae57617b42b4a

  • SHA512

    b086cbf368caab100fc52cdfde092d6262512396879279fcafd925a2ba013b8f5743faa78413db336334a38fc5c86d0f5dbf4532162a53ef6364720026643dd0

  • SSDEEP

    196608:qs7RTqMym+7SHwnuyFAHqEs4ezo22zS9nln60R:T7Y11nu+cso2Plnv

Score
10/10
discoveryevasionexploitthemidatrojan

Malware Config

Targets

    • Target

      fdvs.exe

    • Size

      7.4MB

    • MD5

      84ce5fd0128b726ac96fe36b2487f2cb

    • SHA1

      85d72d2107bfada76b93b87aac159434feb5655b

    • SHA256

      4e26769763d85b15d722bf3257809ebaf7248b6b05aaaf38312ae57617b42b4a

    • SHA512

      b086cbf368caab100fc52cdfde092d6262512396879279fcafd925a2ba013b8f5743faa78413db336334a38fc5c86d0f5dbf4532162a53ef6364720026643dd0

    • SSDEEP

      196608:qs7RTqMym+7SHwnuyFAHqEs4ezo22zS9nln60R:T7Y11nu+cso2Plnv

    Score
    10/10
    discoveryevasionexploitthemidatrojan

    • Modifies security service

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Stops running service(s)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Modifies file permissions

      discovery

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

1
T1497

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks