Overview

overview

9

Static

static

3

WW-Unlock-All.exe

windows7-x64

9

WW-Unlock-All.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WW-Unlock-All.exe

  • Size

    37.0MB

  • Sample

    240525-brh47ahh32

  • MD5

    aa4776a1f805e24a8d3a5a4f40f2c4ad

  • SHA1

    33059aa20fb3fe4e63060ec0522f2ef6b92e8037

  • SHA256

    d58317aa45038dba12f984acf330e8b320fd02acc7dae2dbb3d552abf57378e7

  • SHA512

    08b3673e89bca857ad47edaadfe6f2df0152256e83dfe058cf9b7c4f8c9397173a95cf33bc571cf9377c2b56347272231ab970b77a57ff8865f9b44ae73c4c64

  • SSDEEP

    786432:GPOf6psATJ9Udzg5TwLoIe3ODPK5tBRTwhdknCi/tQ47TNx:GPOfWsAdSdzGELoIejrnwrk7/tQ4n

Score
9/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      WW-Unlock-All.exe

    • Size

      37.0MB

    • MD5

      aa4776a1f805e24a8d3a5a4f40f2c4ad

    • SHA1

      33059aa20fb3fe4e63060ec0522f2ef6b92e8037

    • SHA256

      d58317aa45038dba12f984acf330e8b320fd02acc7dae2dbb3d552abf57378e7

    • SHA512

      08b3673e89bca857ad47edaadfe6f2df0152256e83dfe058cf9b7c4f8c9397173a95cf33bc571cf9377c2b56347272231ab970b77a57ff8865f9b44ae73c4c64

    • SSDEEP

      786432:GPOf6psATJ9Udzg5TwLoIe3ODPK5tBRTwhdknCi/tQ47TNx:GPOfWsAdSdzGELoIejrnwrk7/tQ4n

    Score
    9/10
    bootkitevasionpersistencetrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks