9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2

General

Target

9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Size

488KB
MD5

23221a190bdd75aacec7b8521df5c2b0
SHA1

47a94daebbdaf1bb1ecee16845cb4e1116d8a0d5
SHA256

9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2
SHA512

e1ed733e0c9c9bb66f6eb897835f3fcd285d6e6ce7669ada98af2f53eaaadc39bf4060fbc5124a22498eebcf6d9eebb3e3db98ea042ef9259ad5d711a8250752
SSDEEP

12288:p46SDX7vQHuii8AEbkQWq9cpRAjjgsvbKFWFk7Mghrl9VMu:NSDrIHBBbbVvckjjgsvpFy5fMu

Score

7^/10

themida

Malware Config

Signatures

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1096-56-0x0000000000400000-0x000000000050C000-memory.dmp	themida
behavioral1/memory/1096-57-0x0000000000400000-0x000000000050C000-memory.dmp	themida

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" \DelayServices	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1096	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
1096	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1096	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1096	9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe

C:\Users\Admin\AppData\Local\Temp\9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe
"C:\Users\Admin\AppData\Local\Temp\9d94a6567aba564f71e9c772ed1cd9f9049becbe3c199294b124d6b636eee1f2.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1096-55-0x0000000074F61000-0x0000000074F63000-memory.dmp

Filesize
8KB

Download
memory/1096-56-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/1096-57-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing