Overview

overview

10

Static

static

7

Pumpkhn_Un...1).exe

windows10-2004-x64

9

Pumpkhn_Un...1).exe

windows11-ltsc_2024-x64

9

Pumpkhn_Un...ep.exe

windows10-2004-x64

10

Pumpkhn_Un...ep.exe

windows11-ltsc_2024-x64

10

Pumpkhn_Un...IN.exe

windows10-2004-x64

3

Pumpkhn_Un...IN.exe

windows11-ltsc_2024-x64

3

Pumpkhn_Un...64.exe

windows10-2004-x64

1

Pumpkhn_Un...64.exe

windows11-ltsc_2024-x64

1

Pumpkhn_Un...16.exe

windows10-2004-x64

Pumpkhn_Un...16.exe

windows11-ltsc_2024-x64

Pumpkhn_Un...IT.exe

windows10-2004-x64

1

Pumpkhn_Un...IT.exe

windows11-ltsc_2024-x64

1

Pumpkhn_Un...LL.dll

windows10-2004-x64

3

Pumpkhn_Un...LL.dll

windows11-ltsc_2024-x64

3

Pumpkhn_Un...YS.sys

windows10-2004-x64

3

Pumpkhn_Un...YS.sys

windows11-ltsc_2024-x64

3

Pumpkhn_Un...64.sys

windows10-2004-x64

3

Pumpkhn_Un...64.sys

windows11-ltsc_2024-x64

3

Pumpkhn_Un...64.sys

windows10-2004-x64

3

Pumpkhn_Un...64.sys

windows11-ltsc_2024-x64

3

Pumpkhn_Un...H1.exe

windows10-2004-x64

3

Pumpkhn_Un...H1.exe

windows11-ltsc_2024-x64

8

Pumpkhn_Un...er.exe

windows10-2004-x64

6

Pumpkhn_Un...er.exe

windows11-ltsc_2024-x64

6

Pumpkhn_Un...AC.exe

windows10-2004-x64

7

Pumpkhn_Un...AC.exe

windows11-ltsc_2024-x64

8

Pumpkhn_Un...er.bat

windows10-2004-x64

4

Pumpkhn_Un...er.bat

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    Pumpkhn_UnhwidBan (1).rar
  • Size 94.0MB
  • Sample261102-p77pdatwht
  • SHA256 7db8b038e464707d8335e515caf97203705dcff5b26ca7fc0e8ceba5b57e0fc2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarethemidatrojan

Malware Config

Targets

    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/AppleCleaner (1).exe
    • Size 3.4MB
    • SHA256 1ba5b7689c14fc780b878dd8128a34a41f5ccd8b59ded4967abbb6d573dcf6ef
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Modifies Windows Firewall

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

      defense_evasion
    behavioral1behavioral2
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/CleanBan_SysPrep.exe
    • Size 96.2MB
    • SHA256 90382ea191a1bca4ae68ae5d5cd1f6a5173dca8bd70f119b8eec305098ae24c6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwaretrojanadwarespyware

    • UAC bypass

      defense_evasiontrojan

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral3behavioral4
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/AMIDEWIN.EXE
    • Size 148KB
    • SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/AMIDEWINx64.EXE
    • Size 453KB
    • SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/DMI16.EXE
    • Size 30KB
    • SHA256 28e6e1908f2996af9b7a9930f13d4c770d6963425df0869ce4bcdb1442a4a917
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/DMIEDIT.EXE
    • Size 3.2MB
    • SHA256 5d37e5e7ce01549965bf2166adcba33d1e2c4bd2c90711032f3987b58452ce49
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/UCOREDLL.DLL
    • Size 112KB
    • SHA256 78a4d8e5e8c33793e5a2020325d3a49e92e4826167742e93179bdacbf167b409
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/UCORESYS.SYS
    • Size 15KB
    • SHA256 fd6f56189cd723b32fc06392867fcd5128e63d8b5801e4f7a83523f820531981
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral15behavioral16
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/UCOREW64.SYS
    • Size 14KB
    • SHA256 a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral17behavioral18
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/amifldrv64.sys
    • Size 18KB
    • SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral19behavioral20
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/FN Cleaner/FortniteTracerCleaner1803-21H1.exe
    • Size 304KB
    • SHA256 9d3f799ffdaf3da704f48ada30c786b1ad5294c2f449c1aa6305d2f56bf74c4a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryexecutionadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral21behavioral22
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/HWID Key Changer.exe
    • Size 636KB
    • SHA256 2c141c06f7df57f11ef2c62f2a96093484a65df47065b1a475c53784af0e2664
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral23behavioral24
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/TMAC.exe
    • Size 5.1MB
    • SHA256 a453b3ea8d8133531fad26b18701c694c324cc201e3069d07e99f0e100908c1a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarediscoveryspywarepersistenceransomware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral25behavioral26
    • Target
      Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/serial_checker.bat
    • Size 454B
    • SHA256 56e0af9513d41127dd33933116970b3d2560d0586f7a64b6ffdf215d1fc762ab
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    discoveryexecutionadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral27behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

Installer Packages

1
T1546.016

Netsh Helper DLL

1
T1546.007

Power Settings

1
T1653

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

Installer Packages

1
T1546.016

Netsh Helper DLL

1
T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Debugger Evasion

1
T1622

Direct Volume Access

1
T1006

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Browser Information Discovery

1
T1217

Debugger Evasion

1
T1622

Network Service Discovery

1
T1046

Peripheral Device Discovery

2
T1120

Query Registry

10
T1012

System Information Discovery

11
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

themida
Score
7/10

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationthemidatrojan
Score
9/10

behavioral2

defense_evasiondiscoveryexecutionthemidatrojan
Score
9/10

behavioral3

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwaretrojan
Score
10/10

behavioral4

adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan
Score
10/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

discoveryexecution
Score
3/10

behavioral22

adwarediscoveryexecutionpersistenceransomwarespyware
Score
8/10

behavioral23

discovery
Score
6/10

behavioral24

discovery
Score
6/10

behavioral25

adwarediscoveryspyware
Score
7/10

behavioral26

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral27

discoveryexecution
Score
4/10

behavioral28

adwarediscoveryexecutionpersistenceransomwarespyware
Score
8/10