f1b5e92a8287d67231ddf169b38a16083f96c5e1726d99308d2f32e8ea4ab43f

General

Target
Isass.exe
Size 14.3MB
Sample260423-prxt8sb17j
SHA256 f1b5e92a8287d67231ddf169b38a16083f96c5e1726d99308d2f32e8ea4ab43f
MD5 6089bdb3627c5b3d8175f4cf76be46e0
SHA1 50c531c4c360723058b057643a3586fac79da60f
SHA512 d54241a6a59168e11d4fd8e625f78b6baa9f0406792b99ef5de15d20210d178cb7bfd80534dc49d20eee28df1de70bbe4df1eba6faed266603ecbfad5bfc2b79
SSDEEP 196608:igtptjGKZ+fq0sKYu/PaQrBuN1BbWTQscK2pUZMAbUEO3oDDJf6Wv/VJ8KnWWo39:zpI8QrUN1QgUSAoEO3o3Jx/VJWPw4y
TLSH
T1A8E633E28E112035C276EBF33A46AD7D137FB67720B87795332DB80AD98A451137D8A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Isass.exe
- Size 14.3MB
- SHA256 f1b5e92a8287d67231ddf169b38a16083f96c5e1726d99308d2f32e8ea4ab43f
- MD5 6089bdb3627c5b3d8175f4cf76be46e0
- SHA1 50c531c4c360723058b057643a3586fac79da60f
- SHA512 d54241a6a59168e11d4fd8e625f78b6baa9f0406792b99ef5de15d20210d178cb7bfd80534dc49d20eee28df1de70bbe4df1eba6faed266603ecbfad5bfc2b79
- SSDEEP 196608:igtptjGKZ+fq0sKYu/PaQrBuN1BbWTQscK2pUZMAbUEO3oDDJf6Wv/VJ8KnWWo39:zpI8QrUN1QgUSAoEO3o3Jx/VJWPw4y
- TLSH
  T1A8E633E28E112035C276EBF33A46AD7D137FB67720B87795332DB80AD98A451137D8A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan upx
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2