fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439

Analysis

max time kernel
130s
max time network
145s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe
Size

2.1MB
MD5

c78709bb94e8f9abd4cbad671bb94fc0
SHA1

c6124c94c648e73e6617fc8282718f7eadbaf212
SHA256

fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439
SHA512

76cd1586827ce8f028e7811d88b8f1f23c5e4a2a0542d2ef373b5a3d71537645ef38a3b9f096b90dc01186d47e0799560f092e2f126b649bedca3877c9bbd3e3
SSDEEP

49152:ZIHGSGcIVHzY+JMB7kUunLkoVNv+0yeoi2QsRRioMWenBQxtZSp3uMwj:ZIHGSGcIVHzY+JMB7kUunLkonG0L4iob

Score

7^/10

evasion persistence themida

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine	fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/620-54-0x0000000000400000-0x0000000000627000-memory.dmp	themida
behavioral1/memory/620-56-0x0000000000400000-0x0000000000627000-memory.dmp	themida
behavioral1/memory/620-57-0x0000000000400000-0x0000000000627000-memory.dmp	themida
behavioral1/memory/620-58-0x0000000000400000-0x0000000000627000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Virtual VCSIP V4.0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\msvcsip4.exe\""	fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

pid process

620 fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

pid process

620 fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

pid	process
620	fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

pid	process
620	fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe

C:\Users\Admin\AppData\Local\Temp\fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe
"C:\Users\Admin\AppData\Local\Temp\fff87d4a277b75085a13f5d6804fdab5bad012fa345be37f5d7ebdb6cea19439.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-54-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/620-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/620-56-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/620-57-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/620-58-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download