7852f122730d462c1db45d5ba865726d81b864dcc5e5ddab28eeb7e24cd94bf1 | Triage

Sharing

General

Target

Wondershare Recoverit 10.5.13.4 (x64)_crackshash.zip
Size

264.5MB
Sample

230521-lncs4sca21
MD5

d3b65b2db47cda6126e56e3c42db2a5b
SHA1

ce8259860ae9c0c856538d0cb5424d6dabe73420
SHA256

7852f122730d462c1db45d5ba865726d81b864dcc5e5ddab28eeb7e24cd94bf1
SHA512

0c5f64e4f5101ec2c9da654a265789814491f02e883aa24c175cc4c16ead3b3bab099057819d62b47e8c28984793dc25dd7a9fa41557f206f2d99f57ff3c320c
SSDEEP

6291456:JN899GmD94e+PPZckyPyr4rVpjeH0nwiaBcbZDtFKsO45:kbBDaemckyP84rVIH6w/mZDt60

Score

9^/10

bootkit evasion persistence trojan upx

Malware Config

Targets

- Target
  
  Wondershare Recoverit.exe
- Size
  
  13.9MB
- MD5
  
  dec665d1395fe20a67f0fc74982d0b5b
- SHA1
  
  3fc7b4740a87382038400a1cb0f52fd70c23e42a
- SHA256
  
  df63533e80d2f04ef0c3ff36eb8a35fdebd985a5938dd6120cbeb3c8d35de454
- SHA512
  
  5343a003738112b6ec1b1628b8c85e4bf3d670f18942ea5d5fa88b9e9bfb0c4dccaa280ae649eccc014358a5b5ac5a4a3046b1cb2d3a2b651a2c77018f62e532
- SSDEEP
  
  393216:u64eVEjxaFwUOOGvBML9ZHHOC/hdmR0Xd7PV:Oe00OZrBed/hdRXd7PV
Score

9^/10

bootkit evasion persistence trojan upx
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  Wondershare-data.svm
- Size
  
  496.3MB
- MD5
  
  2fbfd9a480883d77eb4f25bb62ee3569
- SHA1
  
  3a3e525923082bc4d6fd2adc31addd8fd0f0d2fb
- SHA256
  
  aca76d079c1ee3a7630d6463b0734f21f78fa0c99f837e0b64e0c723300740b2
- SHA512
  
  384d96058ca47b002f5b505facf1ce71536deeaf5adf07d3d137dccd66b34d480aaeea3422a1c7cee2d7ae21cf4eba77ccfaa3177b297eea21aaa0ae06da76e8
- SSDEEP
  
  6291456:8rclPLyxaj2RMafALx3t9K+HwFfuJtp2K2vo:8Yl+xajq/g2A
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

bootkitevasionpersistencetrojanupx

behavioral3

behavioral4