855eaf837715b53f39ef38a6cf35611dcba17cd1a713aff5259fb4cad33f9e4a

Analysis

max time kernel
147s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSSOLUTION2.exe
Size

4.0MB
MD5

139dcbaa31257304b6d21c001ae0a39b
SHA1

2de22168d5563e8457195445bab151877feacded
SHA256

855eaf837715b53f39ef38a6cf35611dcba17cd1a713aff5259fb4cad33f9e4a
SHA512

0b1a89b496c6dc2a2076e88d64938ebf45926e53c4916c43dbc0eeecb8702845f99040aa024021ed28c49e8cbdabcdf8b2caaa49904e35c5e702ada88492fa12
SSDEEP

98304:XUoFAcixoG77xOCIECEmSzw/v9+W2P5ndGkIiKwSl2Uh14s:nRAoGnMECvS0/vU/hzIi9Sl2bs

Score

9^/10

evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MSSOLUTION2.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\zyYpVqAWijwKphMjx\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\zyYpVqAWijwKphMjx"	mapper.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MSSOLUTION2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MSSOLUTION2.exe

Executes dropped EXE 1 IoCs

pid	Process
1676	mapper.exe

Loads dropped DLL 1 IoCs

pid	Process
2500	MSSOLUTION2.exe

Themida packer 19 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2500-0-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-2-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-3-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-4-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-14-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-15-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-17-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-18-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-19-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-20-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-21-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-22-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-23-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-24-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-25-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-26-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-27-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-28-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida
behavioral1/memory/2500-29-0x0000000140000000-0x0000000140AB5000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MSSOLUTION2.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\Tasks\driver.sys	MSSOLUTION2.exe
File created	C:\Windows\System32\Tasks\mapper.exe	MSSOLUTION2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2500	MSSOLUTION2.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	mapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1676	mapper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1676	mapper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2356	2500	MSSOLUTION2.exe	31
PID 2500 wrote to memory of 2356	2500	MSSOLUTION2.exe	31
PID 2500 wrote to memory of 2356	2500	MSSOLUTION2.exe	31
PID 2500 wrote to memory of 1676	2500	MSSOLUTION2.exe	32
PID 2500 wrote to memory of 1676	2500	MSSOLUTION2.exe	32
PID 2500 wrote to memory of 1676	2500	MSSOLUTION2.exe	32
PID 1676 wrote to memory of 3068	1676	mapper.exe	34
PID 1676 wrote to memory of 3068	1676	mapper.exe	34
PID 1676 wrote to memory of 3068	1676	mapper.exe	34
PID 2500 wrote to memory of 2012	2500	MSSOLUTION2.exe	36
PID 2500 wrote to memory of 2012	2500	MSSOLUTION2.exe	36
PID 2500 wrote to memory of 2012	2500	MSSOLUTION2.exe	36
PID 2500 wrote to memory of 2908	2500	MSSOLUTION2.exe	37
PID 2500 wrote to memory of 2908	2500	MSSOLUTION2.exe	37
PID 2500 wrote to memory of 2908	2500	MSSOLUTION2.exe	37
PID 2500 wrote to memory of 2152	2500	MSSOLUTION2.exe	38
PID 2500 wrote to memory of 2152	2500	MSSOLUTION2.exe	38
PID 2500 wrote to memory of 2152	2500	MSSOLUTION2.exe	38
PID 2500 wrote to memory of 2680	2500	MSSOLUTION2.exe	39
PID 2500 wrote to memory of 2680	2500	MSSOLUTION2.exe	39
PID 2500 wrote to memory of 2680	2500	MSSOLUTION2.exe	39
PID 2500 wrote to memory of 2784	2500	MSSOLUTION2.exe	40
PID 2500 wrote to memory of 2784	2500	MSSOLUTION2.exe	40
PID 2500 wrote to memory of 2784	2500	MSSOLUTION2.exe	40
PID 2500 wrote to memory of 2928	2500	MSSOLUTION2.exe	41
PID 2500 wrote to memory of 2928	2500	MSSOLUTION2.exe	41
PID 2500 wrote to memory of 2928	2500	MSSOLUTION2.exe	41
PID 2500 wrote to memory of 2840	2500	MSSOLUTION2.exe	42
PID 2500 wrote to memory of 2840	2500	MSSOLUTION2.exe	42
PID 2500 wrote to memory of 2840	2500	MSSOLUTION2.exe	42
PID 2500 wrote to memory of 2760	2500	MSSOLUTION2.exe	43
PID 2500 wrote to memory of 2760	2500	MSSOLUTION2.exe	43
PID 2500 wrote to memory of 2760	2500	MSSOLUTION2.exe	43
PID 2500 wrote to memory of 2576	2500	MSSOLUTION2.exe	44
PID 2500 wrote to memory of 2576	2500	MSSOLUTION2.exe	44
PID 2500 wrote to memory of 2576	2500	MSSOLUTION2.exe	44
PID 2500 wrote to memory of 2864	2500	MSSOLUTION2.exe	45
PID 2500 wrote to memory of 2864	2500	MSSOLUTION2.exe	45
PID 2500 wrote to memory of 2864	2500	MSSOLUTION2.exe	45
PID 2500 wrote to memory of 2748	2500	MSSOLUTION2.exe	46
PID 2500 wrote to memory of 2748	2500	MSSOLUTION2.exe	46
PID 2500 wrote to memory of 2748	2500	MSSOLUTION2.exe	46
PID 2500 wrote to memory of 2592	2500	MSSOLUTION2.exe	47
PID 2500 wrote to memory of 2592	2500	MSSOLUTION2.exe	47
PID 2500 wrote to memory of 2592	2500	MSSOLUTION2.exe	47
PID 2500 wrote to memory of 2744	2500	MSSOLUTION2.exe	48
PID 2500 wrote to memory of 2744	2500	MSSOLUTION2.exe	48
PID 2500 wrote to memory of 2744	2500	MSSOLUTION2.exe	48
PID 2500 wrote to memory of 2852	2500	MSSOLUTION2.exe	49
PID 2500 wrote to memory of 2852	2500	MSSOLUTION2.exe	49
PID 2500 wrote to memory of 2852	2500	MSSOLUTION2.exe	49
PID 2500 wrote to memory of 2572	2500	MSSOLUTION2.exe	50
PID 2500 wrote to memory of 2572	2500	MSSOLUTION2.exe	50
PID 2500 wrote to memory of 2572	2500	MSSOLUTION2.exe	50
PID 2500 wrote to memory of 2588	2500	MSSOLUTION2.exe	51
PID 2500 wrote to memory of 2588	2500	MSSOLUTION2.exe	51
PID 2500 wrote to memory of 2588	2500	MSSOLUTION2.exe	51
PID 2500 wrote to memory of 2648	2500	MSSOLUTION2.exe	52
PID 2500 wrote to memory of 2648	2500	MSSOLUTION2.exe	52
PID 2500 wrote to memory of 2648	2500	MSSOLUTION2.exe	52
PID 2500 wrote to memory of 3028	2500	MSSOLUTION2.exe	53
PID 2500 wrote to memory of 3028	2500	MSSOLUTION2.exe	53
PID 2500 wrote to memory of 3028	2500	MSSOLUTION2.exe	53
PID 2500 wrote to memory of 3056	2500	MSSOLUTION2.exe	54

C:\Users\Admin\AppData\Local\Temp\MSSOLUTION2.exe
"C:\Users\Admin\AppData\Local\Temp\MSSOLUTION2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 5
  2⤵
  PID:2356
- C:\Windows\System32\Tasks\mapper.exe
  C:\Windows\System32\Tasks\mapper.exe C:\Windows\System32\Tasks\driver.sys > NUL 2>&1
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Venom Solution
    3⤵
    PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:2168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c exit
  2⤵
  PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\Tasks\mapper.exe

Filesize
530KB

MD5
e64a27c9cddaef671eb2676c5ef38129

SHA1
1127c6ca536514881727711d7b7b6a66e7442835

SHA256
cbb2682983d3248dd5403141382a909c4ae8a0f3e27b605be3ee93f6cb76f804

SHA512
a96ddb28ccfbbe9224f22fb9db51689573a1325568082b0c8a760b48850a72f82daba14115a872140ecf2d706cafb2e7823c85bd3587e95664bb02bc8336525f

Download Submit
memory/2500-18-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-20-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-3-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-4-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-1-0x0000000077910000-0x0000000077912000-memory.dmp

Filesize
8KB

Download
memory/2500-14-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-16-0x0000000077910000-0x0000000077912000-memory.dmp

Filesize
8KB

Download
memory/2500-15-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-17-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-0-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-2-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-21-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-19-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-22-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-23-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-24-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-25-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-26-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-27-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-28-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download
memory/2500-29-0x0000000140000000-0x0000000140AB5000-memory.dmp

Filesize
10.7MB

Download