1cc7c5968d8bb64fb741c13772986779834eca8293d230cd88aa305c304e89c2 | Triage

Sharing

General

Target

modest menu v0.9.10.zip
Size

14.2MB
Sample

241021-bvq9za1hje
MD5

d398b8b3d9610600e8613dd537e70a98
SHA1

22871b487f334a53eee8399f41d0e2ada796431e
SHA256

1cc7c5968d8bb64fb741c13772986779834eca8293d230cd88aa305c304e89c2
SHA512

10808ff2f1e0385b2de9cd710fdbebb01b8d0be62d9c5da710cd3e06e7d878a6214569969d3091eda12b7ad4d3d45168de28cd5b4664596ca5cc5d8cf055947c
SSDEEP

393216:6C+VjBgl/RQtHqPdmH9+eXcPt0w8da+/DBYVnAwDGqoc83/t77U6BClF:6ljBgRRQN9Tcr8IwtYRQZ/gT

Score

9^/10

discovery evasion themida trojan

Malware Config

Targets

- Target
  
  modest menu v0.9.10.zip
- Size
  
  14.2MB
- MD5
  
  d398b8b3d9610600e8613dd537e70a98
- SHA1
  
  22871b487f334a53eee8399f41d0e2ada796431e
- SHA256
  
  1cc7c5968d8bb64fb741c13772986779834eca8293d230cd88aa305c304e89c2
- SHA512
  
  10808ff2f1e0385b2de9cd710fdbebb01b8d0be62d9c5da710cd3e06e7d878a6214569969d3091eda12b7ad4d3d45168de28cd5b4664596ca5cc5d8cf055947c
- SSDEEP
  
  393216:6C+VjBgl/RQtHqPdmH9+eXcPt0w8da+/DBYVnAwDGqoc83/t77U6BClF:6ljBgRRQN9Tcr8IwtYRQZ/gT
Score

1^/10
behavioral1 behavioral2
- Target
  
  modest-menu_v0.9.10/config.json
- Size
  
  3KB
- MD5
  
  3bea77ef233e2e32636ba889ceb489e3
- SHA1
  
  6a0a6be2e24cd5497fbf0298e244234716f5419a
- SHA256
  
  a8732f591cbed2b2ab923236d22948f10cb7c4011d6a1018be2fe3c8e8fbf5f2
- SHA512
  
  c924567c6c683b90b6dd31af7e976a8222d164c99137b38149ef79d4a1222b35c8bdfef155ee071e66c38b1601f3868c22c30d477fbc5f2dcd7599cd7f4be707
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  modest-menu_v0.9.10/modest-menu.exe
- Size
  
  14.3MB
- MD5
  
  f0851119cec15d35a8f206f1ba446f86
- SHA1
  
  5ff263672af7e81a344846b3bce1ff4e59f8b6cd
- SHA256
  
  19a82f12d86829e768d226c0ec5e20a664f349d1bbabd3aaeade3ff3d7237282
- SHA512
  
  2ccbe9d55b59bc22ce615f23a09baa66d15e88f7c44e8f5561c54b410d02cb309d40865fd22694470fc9cfbda69ad12fb699427778347e49db63d60a341cf5ea
- SSDEEP
  
  393216:rO4LKZjqtG+kh/JUwReHLsLjbeeE8KohlBM2Dd1rzO:rrKZjLhDUHimEJhD
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6
- Target
  
  modest-menu_v0.9.10/scripts/Readme.api
- Size
  
  24KB
- MD5
  
  36754844e4b9d76b810066b529af0e5b
- SHA1
  
  da8c4031d42ae41a796b409d525883b71c23bd0f
- SHA256
  
  668a8e8430485417796ea563eb97fd366fdaa2f7fc6769bf5a18626f19aef1f6
- SHA512
  
  5e0eba72a25c4d8f9727bf4ec2f3ae7dacd71b34df710bb7daf41c5f3dc6ca08473de783580d0b2982831f93394dcac485c9980f46af6973af96aeb03e9de659
- SSDEEP
  
  192:qNzc4v05Feq0hHBjBCpGjem0uezAsNpGlbWXxX5IS+wwSgU0FXxZujFS+JraytK2:h5ChWGjemBZWXxX5MO0FrujPJreOi4
Score

3^/10
behavioral7 behavioral8
- Target
  
  modest-menu_v0.9.10/scripts/demo.lua
- Size
  
  429B
- MD5
  
  a0cdff1f4eaf5af121513b9885295341
- SHA1
  
  e40fc44c5b82a8c02e7248c8b104c0f8abdc4f97
- SHA256
  
  f2b354df9b4d661f6227132c39937b8f706626886cdcf65540ebc5b78f55f6ea
- SHA512
  
  1bf19f211a11c6b88ca9583ff20c1c8ed3e14f8f7ff68622a37c5c151ef2473e41bfd2b503bcc99f6e6e3f79b6845678cecfd3e23406353f35883fbf9b2beecd
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  modest-menu_v0.9.10/scripts/sirius.lua.example
- Size
  
  468B
- MD5
  
  1fdd7bce4f24c51ec8267d7fe65b265e
- SHA1
  
  4f247776830fb30cf816f227f13d3645b8d3aa6d
- SHA256
  
  d331a1344d7354019fdeb564a21f95f85f26458f91aa93d7af58affa9728cb1d
- SHA512
  
  4bf9c85600dcab2ff532ef5f459c270d3197ea5a9d46677b4f7f1e0d2e3b3454bc5ba1f64bcb732448cbe37a71a2112511f46166ec4ba0f3db1ca14d4f685bb4
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  modest-menu_v0.9.10/scripts/vehicle.lua
- Size
  
  306B
- MD5
  
  1eceb52600b875b85a169687fb62ed1e
- SHA1
  
  2d13ed39f1d757af9a5d07790065cc8c00c4984b
- SHA256
  
  0cddccf554633f15fbc453cd0080469c3806d7bd13824f68e3a1ee0cfb2da20b
- SHA512
  
  23baa825d5c3dfb66d1582ce6332bee8272f345742ba50977c0622c7be4fb6b9b921b473a424a2453df3cbc0ff0b473cf7897955fe09a4fd7a10d0df2ef2188b
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  modest-menu_v0.9.10/scripts/weapon.lua
- Size
  
  277B
- MD5
  
  402a9279c76afb2c5977cf97d270c3d1
- SHA1
  
  4cd6474f3cbf9c3ca26277d5691460e8744aae59
- SHA256
  
  20d2e8d52504c96dcb846b08da138418048ed3b58128b05ddf1bde09694c5c14
- SHA512
  
  7357aff15e11de58da79a4eaa603c5ad7fb16ec426e71358e87dd14862d19c44b80896c0e66766479978bb0ba88704457b5356f9f86f6f4af41a39c52ffa45db
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  modest-menu_v0.9.10/themes.json
- Size
  
  2KB
- MD5
  
  ecc97a512f2bee4c4344a7a4126b5a5b
- SHA1
  
  73cd4d3e586b17d307decebd1ba8bea105977e29
- SHA256
  
  b5eeb2b5d8656f0399220039f15e50c2566bf13124681f67c65f8b042d8fdc4c
- SHA512
  
  4d411ea0b3c67f2b38034fc9c1491dca070801e6521cc7cd8cdf91e2343a7caa7861313445e3d53cbe8dc8f64a0ce8169b191a054536c186dc2d1dcfba25bd18
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

evasionthemidatrojan

behavioral6

evasionthemidatrojan

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18