Triage | Malware sandboxing report by Hatching Triage

Sharing

General

Target

559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0
Size

3MB
Sample

230319-cx2ddsee68
MD5

190a6ae730a81c5a672e2d8498e230ff
SHA1

1e2457b2a56aafd15424a420813a13f52cda6287
SHA256

559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0
SHA512

946e6b2793e8fa8fb57b16f889b8ba2bf9b8a48d5c2fedd0806db81086d59ff7fd5bce67a623e715329263569b3757442aba49d614a1954cdc998cbc68ea50ec
SSDEEP

49152:7r1c7Kvf8e9HTgXHXayMSTQ5c1ztH9rDDQvOJRg05T0Oa/rm2ho8IucxzrurVloF:QKvfd94XayMT5sH9M0aS8o9uWyUhHy0

Score

9^/10

discovery evasion trojan upx

Malware Config

Targets

- Target
  
  559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0
- Size
  
  3MB
- MD5
  
  190a6ae730a81c5a672e2d8498e230ff
- SHA1
  
  1e2457b2a56aafd15424a420813a13f52cda6287
- SHA256
  
  559343650622dff6f46762a32ff54c03ac8296f700d8914812440af4c9e0a5c0
- SHA512
  
  946e6b2793e8fa8fb57b16f889b8ba2bf9b8a48d5c2fedd0806db81086d59ff7fd5bce67a623e715329263569b3757442aba49d614a1954cdc998cbc68ea50ec
- SSDEEP
  
  49152:7r1c7Kvf8e9HTgXHXayMSTQ5c1ztH9rDDQvOJRg05T0Oa/rm2ho8IucxzrurVloF:QKvfd94XayMT5sH9M0aS8o9uWyUhHy0
Score

9^/10

discovery evasion trojan upx
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Modifies file permissions
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Scheduled Task

Privilege Escalation

Tasks

static1

behavioral1

discoveryevasiontrojanupx