dcd5b76de9828767e8acbfcf3be792fbd1b777651ca2e802294989bae7ddf1d9

Resubmissions

14/05/2023, 21:59

230514-1v4bzaga2y 9

14/05/2023, 20:19

230514-y38wbafg2z 9

Analysis

max time kernel
26s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/05/2023, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InvChanger/injector_imgui.exe
Size

3.4MB
MD5

00b703e2dd4b6080d4dcec7cab4373d6
SHA1

78a9621f44be60150f784b68c2e4367af07a3d1a
SHA256

2a673052ee30c8193ff3e03be32f980452e63695211080ab0513d84106db443c
SHA512

f0164eabdaed93be1218e5b68bfe86a025c0498585bc0d3b5057b8ebd58935330e338be06cfd6965863b0af9cc86298d935fe2f0ce3ed5bf3e576c812cde4d9f
SSDEEP

98304:Jt4igwu/cqS8jQ+zRwLjwqzMznCYG0U78p:JicqS4Q+Vw3VGG0a8p

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	injector_imgui.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	injector_imgui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	injector_imgui.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/memory/1232-54-0x0000000000C30000-0x000000000144B000-memory.dmp	themida
behavioral3/memory/1232-55-0x0000000000C30000-0x000000000144B000-memory.dmp	themida
behavioral3/memory/1232-56-0x0000000000C30000-0x000000000144B000-memory.dmp	themida
behavioral3/memory/1232-57-0x0000000000C30000-0x000000000144B000-memory.dmp	themida
behavioral3/memory/1232-58-0x0000000000C30000-0x000000000144B000-memory.dmp	themida
behavioral3/memory/1232-59-0x0000000000C30000-0x000000000144B000-memory.dmp	themida
behavioral3/memory/1232-60-0x0000000000C30000-0x000000000144B000-memory.dmp	themida
behavioral3/memory/1232-238-0x0000000000C30000-0x000000000144B000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	injector_imgui.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	injector_imgui.exe

C:\Users\Admin\AppData\Local\Temp\InvChanger\injector_imgui.exe
"C:\Users\Admin\AppData\Local\Temp\InvChanger\injector_imgui.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:1232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar50D6.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/1232-54-0x0000000000C30000-0x000000000144B000-memory.dmp

Filesize
8.1MB

Download
memory/1232-55-0x0000000000C30000-0x000000000144B000-memory.dmp

Filesize
8.1MB

Download
memory/1232-56-0x0000000000C30000-0x000000000144B000-memory.dmp

Filesize
8.1MB

Download
memory/1232-57-0x0000000000C30000-0x000000000144B000-memory.dmp

Filesize
8.1MB

Download
memory/1232-58-0x0000000000C30000-0x000000000144B000-memory.dmp

Filesize
8.1MB

Download
memory/1232-59-0x0000000000C30000-0x000000000144B000-memory.dmp

Filesize
8.1MB

Download
memory/1232-60-0x0000000000C30000-0x000000000144B000-memory.dmp

Filesize
8.1MB

Download
memory/1232-238-0x0000000000C30000-0x000000000144B000-memory.dmp

Filesize
8.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads