Overview

overview

10

Static

static

7

2.exe

windows7-x64

10

2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2.exe.exe

  • Size

    7.4MB

  • Sample

    221024-te3l6shef2

  • MD5

    8ddc35d10e70c08abd8a15a787d3b586

  • SHA1

    08219f2e68c5e72a7d218d63cea15bf8db5aff6c

  • SHA256

    057e1aaca82b095ce425737bb5108155c8717868276e68a9fa93084850d2a585

  • SHA512

    99046db0247aebc545daf5e5380a28edec47dffe0b9d036d504bff8616c7c39d2deaa088dac8fe779e497d9b060c76bcb423600426faa70e9ac896de342ed79a

  • SSDEEP

    196608:qs7RTqMym+7SHwnuyFAHqEs4ezo22zS9nln606:T7Y11nu+cso2PlnQ

Score
10/10
discoveryevasionexploitthemidatrojan

Malware Config

Targets

    • Target

      2.exe.exe

    • Size

      7.4MB

    • MD5

      8ddc35d10e70c08abd8a15a787d3b586

    • SHA1

      08219f2e68c5e72a7d218d63cea15bf8db5aff6c

    • SHA256

      057e1aaca82b095ce425737bb5108155c8717868276e68a9fa93084850d2a585

    • SHA512

      99046db0247aebc545daf5e5380a28edec47dffe0b9d036d504bff8616c7c39d2deaa088dac8fe779e497d9b060c76bcb423600426faa70e9ac896de342ed79a

    • SSDEEP

      196608:qs7RTqMym+7SHwnuyFAHqEs4ezo22zS9nln606:T7Y11nu+cso2PlnQ

    Score
    10/10
    discoveryevasionexploitthemidatrojan

    • Modifies security service

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Stops running service(s)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Modifies file permissions

      discovery

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

1
T1497

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks