1fb07da5da3994dd8f00723ce7dd6134c982ba0a738a23e1c8c61202c4dfedac

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Themida.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Themida.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Themida.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	9dca9f65028c1eaed40a8cedbadadd98_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	xThemida.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Themida.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 4 IoCs

pid	Process
5000	xThemida.exe
3564	Themida.exe
1116	Proton.exe
828	Themida.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	Themida.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Themida.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Themida.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
828	Themida.exe
828	Themida.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	1116	WerFault.exe	97

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	Themida.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
828	Themida.exe
828	Themida.exe
828	Themida.exe
828	Themida.exe
828	Themida.exe
828	Themida.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
828	Themida.exe
828	Themida.exe
828	Themida.exe
828	Themida.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 5000	2380	9dca9f65028c1eaed40a8cedbadadd98_JaffaCakes118.exe	91
PID 2380 wrote to memory of 5000	2380	9dca9f65028c1eaed40a8cedbadadd98_JaffaCakes118.exe	91
PID 2380 wrote to memory of 5000	2380	9dca9f65028c1eaed40a8cedbadadd98_JaffaCakes118.exe	91
PID 5000 wrote to memory of 3564	5000	xThemida.exe	92
PID 5000 wrote to memory of 3564	5000	xThemida.exe	92
PID 5000 wrote to memory of 3564	5000	xThemida.exe	92
PID 3564 wrote to memory of 4424	3564	Themida.exe	96
PID 3564 wrote to memory of 4424	3564	Themida.exe	96
PID 3564 wrote to memory of 4424	3564	Themida.exe	96
PID 4424 wrote to memory of 1116	4424	WScript.exe	97
PID 4424 wrote to memory of 1116	4424	WScript.exe	97
PID 4424 wrote to memory of 1116	4424	WScript.exe	97
PID 4424 wrote to memory of 828	4424	WScript.exe	98
PID 4424 wrote to memory of 828	4424	WScript.exe	98
PID 4424 wrote to memory of 828	4424	WScript.exe	98

C:\Users\Admin\AppData\Local\Temp\9dca9f65028c1eaed40a8cedbadadd98_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9dca9f65028c1eaed40a8cedbadadd98_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\xThemida.exe
  "C:\Users\Admin\AppData\Local\Temp\xThemida.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Themida.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Themida.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\run.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Proton.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Proton.exe"
        5⤵
        Executes dropped EXE
        
        PID:1116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 872
        6⤵
        Program crash
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Themida.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Themida.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Checks whether UAC is enabled
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1116 -ip 1116
1⤵
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion