Overview

overview

9

Static

static

7

Watch it.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    Watch it.exe

  • Size

    6.1MB

  • Sample

    241017-p96j4aycke

  • MD5

    4a05c0b98cb6d8cc3f343142763b0b64

  • SHA1

    7e908e67ed9448c13fbe04b3ec1123de10516bec

  • SHA256

    c959f531ea229dca44a36d1d64fdde665061ae7919625b500f66865530590c6a

  • SHA512

    552ffa44f0ba4c9f12c4bf253a8f2a25de7edc86ebc03ddbde263afdcc182fe0eb5f02e9d76edd6cbd53f14fe0e896b29284532699e48b5d7b15ebde6986e814

  • SSDEEP

    98304:2J3bdYu+DGPgQvA138N/vibrdD2q+fM8uT8MzLZJvvPTIKGq7:KrdYEYzph9D2q+khT8MzlZXTIKZ

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      Watch it.exe

    • Size

      6.1MB

    • MD5

      4a05c0b98cb6d8cc3f343142763b0b64

    • SHA1

      7e908e67ed9448c13fbe04b3ec1123de10516bec

    • SHA256

      c959f531ea229dca44a36d1d64fdde665061ae7919625b500f66865530590c6a

    • SHA512

      552ffa44f0ba4c9f12c4bf253a8f2a25de7edc86ebc03ddbde263afdcc182fe0eb5f02e9d76edd6cbd53f14fe0e896b29284532699e48b5d7b15ebde6986e814

    • SSDEEP

      98304:2J3bdYu+DGPgQvA138N/vibrdD2q+fM8uT8MzLZJvvPTIKGq7:KrdYEYzph9D2q+khT8MzlZXTIKZ

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks