Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
9ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
Analysis
-
max time kernel
1794s -
max time network
1809s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-11-2020 14:34
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.exe.dll
Resource
win10v20201028
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v20201028
Behavioral task
behavioral6
Sample
31.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.exe.dll
Resource
win10v20201028
Behavioral task
behavioral14
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
Behavioral task
behavioral16
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
Behavioral task
behavioral18
Sample
HYDRA.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
KLwC6vii.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
Keygen.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral22
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
OnlineInstaller.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v20201028
Behavioral task
behavioral26
Sample
SecuriteInfo.com.Gen.NN.ZexaF.34108.xy1@amqiedE.17985.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
SecuriteInfo.com.Generic.mg.cde56cf0169830ee.29869.dll
Resource
win10v20201028
Behavioral task
behavioral28
Sample
SecurityTaskManager_Setup.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral30
Sample
VyprVPN.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
WSHSetup[1].exe
Resource
win10v20201028
Behavioral task
behavioral32
Sample
Yard.dll
Resource
win10v20201028
General
-
Target
VyprVPN.exe
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
Clipper.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\WinService.exe" Clipper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\WinService.exe" Clipper.exe -
Executes dropped EXE 6 IoCs
Processes:
joinResult.exeVyprVPN.exe1111.exeClipper.exeWinService.exeWinService.exepid process 3772 joinResult.exe 3120 VyprVPN.exe 3304 1111.exe 2816 Clipper.exe 492 WinService.exe 2024 WinService.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1111.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation 1111.exe -
Loads dropped DLL 2 IoCs
Processes:
VyprVPN.exejoinResult.exepid process 540 VyprVPN.exe 3772 joinResult.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
1111.exepid process 3304 1111.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\1337\joinResult.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\1337\joinResult.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\1337\joinResult.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\1337\joinResult.exe nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1111.exepid process 3304 1111.exe 3304 1111.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Clipper.exeWinService.exeWinService.exedescription pid process Token: SeDebugPrivilege 2816 Clipper.exe Token: SeDebugPrivilege 492 WinService.exe Token: SeDebugPrivilege 2024 WinService.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1111.exepid process 3304 1111.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
VyprVPN.exejoinResult.exeClipper.exe1111.execmd.exedescription pid process target process PID 540 wrote to memory of 3772 540 VyprVPN.exe joinResult.exe PID 540 wrote to memory of 3772 540 VyprVPN.exe joinResult.exe PID 540 wrote to memory of 3772 540 VyprVPN.exe joinResult.exe PID 540 wrote to memory of 3120 540 VyprVPN.exe VyprVPN.exe PID 540 wrote to memory of 3120 540 VyprVPN.exe VyprVPN.exe PID 540 wrote to memory of 3120 540 VyprVPN.exe VyprVPN.exe PID 3772 wrote to memory of 3304 3772 joinResult.exe 1111.exe PID 3772 wrote to memory of 3304 3772 joinResult.exe 1111.exe PID 3772 wrote to memory of 3304 3772 joinResult.exe 1111.exe PID 3772 wrote to memory of 2816 3772 joinResult.exe Clipper.exe PID 3772 wrote to memory of 2816 3772 joinResult.exe Clipper.exe PID 2816 wrote to memory of 1920 2816 Clipper.exe schtasks.exe PID 2816 wrote to memory of 1920 2816 Clipper.exe schtasks.exe PID 2816 wrote to memory of 492 2816 Clipper.exe WinService.exe PID 2816 wrote to memory of 492 2816 Clipper.exe WinService.exe PID 3304 wrote to memory of 3628 3304 1111.exe cmd.exe PID 3304 wrote to memory of 3628 3304 1111.exe cmd.exe PID 3304 wrote to memory of 3628 3304 1111.exe cmd.exe PID 3628 wrote to memory of 1896 3628 cmd.exe PING.EXE PID 3628 wrote to memory of 1896 3628 cmd.exe PING.EXE PID 3628 wrote to memory of 1896 3628 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\VyprVPN.exe"C:\Users\Admin\AppData\Local\Temp\VyprVPN.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1337\joinResult.exe"C:\Users\Admin\AppData\Roaming\1337\joinResult.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1337\1111.exe"C:\Users\Admin\AppData\Roaming\1337\1111.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 3 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1337\1111.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 3 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\1337\Clipper.exe"C:\Users\Admin\AppData\Roaming\1337\Clipper.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service" /tr "C:\Users\Admin\WinService.exe" /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\WinService.exe"C:\Users\Admin\WinService.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe"C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\1337\1111.exe
-
C:\Users\Admin\AppData\Roaming\1337\1111.exe
-
C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
-
C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
-
C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
-
C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
-
C:\Users\Admin\AppData\Roaming\1337\joinResult.exeMD5
79022fbafee9fe740a5230f87bd33171
SHA142bf0f7bf41009fd0009535a8b1162cbe60dce6f
SHA256640c30cfa519be11c02c4e51bf18979a93266887cc9ef19076b3d0f1f20528b6
SHA51248e0d4a18d99dce4398de73895a157e13293115b52ee5158f9ea6fc73c4d5f4133e1cebba14ff5482b8c4f7dfeebfe3b003df1caf351314f1cc16944818df4b3
-
C:\Users\Admin\AppData\Roaming\1337\joinResult.exeMD5
79022fbafee9fe740a5230f87bd33171
SHA142bf0f7bf41009fd0009535a8b1162cbe60dce6f
SHA256640c30cfa519be11c02c4e51bf18979a93266887cc9ef19076b3d0f1f20528b6
SHA51248e0d4a18d99dce4398de73895a157e13293115b52ee5158f9ea6fc73c4d5f4133e1cebba14ff5482b8c4f7dfeebfe3b003df1caf351314f1cc16944818df4b3
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
\Users\Admin\AppData\Local\Temp\nsqA0CC.tmp\System.dll
-
\Users\Admin\AppData\Local\Temp\nsz9DAF.tmp\System.dll
-
memory/492-25-0x00007FF9A7730000-0x00007FF9A811C000-memory.dmpFilesize
9.9MB
-
memory/492-22-0x0000000000000000-mapping.dmp
-
memory/1896-34-0x0000000000000000-mapping.dmp
-
memory/1920-21-0x0000000000000000-mapping.dmp
-
memory/2024-38-0x00007FF9A77D0000-0x00007FF9A81BC000-memory.dmpFilesize
9.9MB
-
memory/2816-14-0x00007FF9A7730000-0x00007FF9A811C000-memory.dmpFilesize
9.9MB
-
memory/2816-19-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB
-
memory/2816-11-0x0000000000000000-mapping.dmp
-
memory/3120-18-0x00000000731F0000-0x00000000738DE000-memory.dmpFilesize
6.9MB
-
memory/3120-35-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/3120-4-0x0000000000000000-mapping.dmp
-
memory/3120-36-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/3120-28-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/3120-30-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/3120-31-0x0000000005B40000-0x0000000005B41000-memory.dmpFilesize
4KB
-
memory/3120-32-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/3304-8-0x0000000000000000-mapping.dmp
-
memory/3304-16-0x00000000038E0000-0x00000000038E1000-memory.dmpFilesize
4KB
-
memory/3304-17-0x0000000003AE0000-0x0000000003AE1000-memory.dmpFilesize
4KB
-
memory/3304-15-0x00000000038E0000-0x00000000038E1000-memory.dmpFilesize
4KB
-
memory/3628-33-0x0000000000000000-mapping.dmp
-
memory/3772-1-0x0000000000000000-mapping.dmp