Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
12-06-2024 14:26
General
-
Target
SecuriteInfo.com.Win64.TrojanX-gen.30891.22761.exe
-
Size
5.1MB
-
MD5
418cd9ce60c4a98435abe72d6333a6fa
-
SHA1
e28d09e95e7b20e4221617f8699f17920e2ee5f6
-
SHA256
4e3f9e6b6b8fa20e16cd92627b9544be2bb7bef10c0aecd7158ca52329a63d81
-
SHA512
42540c2648189eaec5a11cb2ff7192def778cb642d50b74da49d9e10a9a082f445259dc18628c89da304c7448d74cc85d2a185e2f778f7d73c857bf8e03c17ee
-
SSDEEP
98304:UJ4LH/Sykw/0xY3/EAE6WrgFQUhb/xib7cLvY/P/HYfZwmg8f8Ie:U6LH/RkwXcrlyQbQs3/aZwmgjB
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.TrojanX-gen.30891.22761.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.TrojanX-gen.30891.22761.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
12.8MB
-
Filesize
12.8MB
-
Filesize
12.8MB
-
Filesize
12.8MB
-
Filesize
12.8MB