a94575a013c33023f85568cbbb102f487f9d1ebd9c2168e7a89a5880dd219118

General

Target
Isass.exe
Size 14.4MB
Sample260530-ap6a9set5l
SHA256 a94575a013c33023f85568cbbb102f487f9d1ebd9c2168e7a89a5880dd219118
MD5 c7946d8260418c679491bb373b20e7f5
SHA1 4bc456a73f85e220328ad0c912ef29eb7b14b99a
SHA512 9eb907f0c7899540fef223172f5a1fabc4e261b4ca446a63ece27118968eabe1f7a836496c4fe0d41841fadccf653532186adc83c09f435fa13e0c77831b5f13
SSDEEP 393216:l4Qm1rNrQrU51YgUSAoEO3o3Jx/VJWpw4Fe:uDdQAXUYEO3o3JFVEp
TLSH
T1D3E633E34E612232C1B6E6FB3F101CBA13237A6326B4AB75A37DB94598454437B7C871
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Isass.exe
- Size 14.4MB
- SHA256 a94575a013c33023f85568cbbb102f487f9d1ebd9c2168e7a89a5880dd219118
- MD5 c7946d8260418c679491bb373b20e7f5
- SHA1 4bc456a73f85e220328ad0c912ef29eb7b14b99a
- SHA512 9eb907f0c7899540fef223172f5a1fabc4e261b4ca446a63ece27118968eabe1f7a836496c4fe0d41841fadccf653532186adc83c09f435fa13e0c77831b5f13
- SSDEEP 393216:l4Qm1rNrQrU51YgUSAoEO3o3Jx/VJWpw4Fe:uDdQAXUYEO3o3JFVEp
- TLSH
  T1D3E633E34E612232C1B6E6FB3F101CBA13237A6326B4AB75A37DB94598454437B7C871
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan upx
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Loads dropped DLL

Themida packer

Checks whether UAC is enabled

Modifies boot configuration data using bcdedit

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2