74cf42fa8e330ff348d07adddeed191ede6edfb97fab2fb045df03e4637b90c8

Analysis

max time kernel
18s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
24-11-2020 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d.exe
Size

11.0MB
MD5

e4cecbd3ecf383a7312caa268c3adf04
SHA1

17d5688ae3586d72b9f94a6dc6b450c33721f01f
SHA256

74cf42fa8e330ff348d07adddeed191ede6edfb97fab2fb045df03e4637b90c8
SHA512

5166c53d9e30221fd9d27fe7782bca9f0a82cced945f7994e3b7e5d103e052870bbbbd2e1a363e21a51f06cc733a3018806d6cd047a935736f7a60ca921c5b67

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

d.tmpwmfdist.exeVirtualDVD.exe

pid process

1412 d.tmp
1700 wmfdist.exe
980 VirtualDVD.exe
Loads dropped DLL 8 IoCs

Processes:

d.exed.tmpVirtualDVD.exe

pid process

1408 d.exe
1412 d.tmp
1412 d.tmp
1412 d.tmp
1412 d.tmp
1412 d.tmp
1412 d.tmp
980 VirtualDVD.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1412	d.tmp
1700	wmfdist.exe
980	VirtualDVD.exe

pid	process
1408	d.exe
1412	d.tmp
1412	d.tmp
1412	d.tmp
1412	d.tmp
1412	d.tmp
1412	d.tmp
980	VirtualDVD.exe

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
\Program Files (x86)\VirtualDVD\unins000.exe	js

Drops file in System32 directory 8 IoCs

Processes:

d.tmp

description	ioc	process
File created	C:\Windows\SysWOW64\VirtualDVD InstallData\x86\is-HH4JM.tmp	d.tmp
File created	C:\Windows\SysWOW64\VirtualDVD InstallData\x64\is-8V4HU.tmp	d.tmp
File created	C:\Windows\SysWOW64\VirtualDVD InstallData\is-PAEFE.tmp	d.tmp
File created	C:\Windows\SysWOW64\VirtualDVD InstallData\is-7BR25.tmp	d.tmp
File created	C:\Windows\SysWOW64\VirtualDVD Windows10 InstallData\x86\is-968RU.tmp	d.tmp
File created	C:\Windows\SysWOW64\VirtualDVD Windows10 InstallData\x64\is-BG0A4.tmp	d.tmp
File created	C:\Windows\SysWOW64\VirtualDVD Windows10 InstallData\is-8HPJ9.tmp	d.tmp
File created	C:\Windows\SysWOW64\VirtualDVD Windows10 InstallData\is-RQKCA.tmp	d.tmp

Drops file in Program Files directory 49 IoCs

Processes:

d.tmp

description	ioc	process
File created	C:\Program Files (x86)\VirtualDVD\language\is-JFFRA.tmp	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\sqlite3.dll	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\DIFxAPI_amd64.dll	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\DIFxAPI_x86.dll	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\is-2K9RH.tmp	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\unins000.dat	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\is-17KDC.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\is-8LLQS.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-N2KMP.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-J8PGM.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-H9K2C.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-UDC3K.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-1UAJO.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-8J1BS.tmp	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\LibSSL\ssleay32.dll	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\is-UTFA1.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-VO6A9.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-FPGHP.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-MLITG.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\is-VEPJ8.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\is-FUQS4.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-CNN4S.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-G9NHH.tmp	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\SmartInstaller_x86.exe	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\LibSSL\is-U055Q.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-LD5KI.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-5CTQR.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-7QL7S.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-264ON.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-VJEV1.tmp	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\Engine.dll	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\is-1PMKA.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\LibSSL\is-9I652.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-H57SL.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-L1ICA.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-PIFL0.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-19KU8.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-NKTQV.tmp	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\VirtualDVD.exe	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\is-1PG1Q.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\is-KJCVI.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\unins000.dat	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\is-DHF6G.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-ONE3O.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-DKI9F.tmp	d.tmp
File created	C:\Program Files (x86)\VirtualDVD\language\is-616OA.tmp	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\LibSSL\libeay32.dll	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\SmartInstaller_amd64.exe	d.tmp
File opened for modification	C:\Program Files (x86)\VirtualDVD\wmfdist.exe	d.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d.tmp

pid process

1412 d.tmp
1412 d.tmp
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d.tmp

pid process

1412 d.tmp

pid	process
1412	d.tmp
1412	d.tmp

pid	process
1412	d.tmp

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

d.exed.tmp

description	pid	process	target process
PID 1408 wrote to memory of 1412	1408	d.exe	d.tmp
PID 1408 wrote to memory of 1412	1408	d.exe	d.tmp
PID 1408 wrote to memory of 1412	1408	d.exe	d.tmp
PID 1408 wrote to memory of 1412	1408	d.exe	d.tmp
PID 1408 wrote to memory of 1412	1408	d.exe	d.tmp
PID 1408 wrote to memory of 1412	1408	d.exe	d.tmp
PID 1408 wrote to memory of 1412	1408	d.exe	d.tmp
PID 1412 wrote to memory of 1700	1412	d.tmp	wmfdist.exe
PID 1412 wrote to memory of 1700	1412	d.tmp	wmfdist.exe
PID 1412 wrote to memory of 1700	1412	d.tmp	wmfdist.exe
PID 1412 wrote to memory of 1700	1412	d.tmp	wmfdist.exe
PID 1412 wrote to memory of 1700	1412	d.tmp	wmfdist.exe
PID 1412 wrote to memory of 1700	1412	d.tmp	wmfdist.exe
PID 1412 wrote to memory of 1700	1412	d.tmp	wmfdist.exe
PID 1412 wrote to memory of 980	1412	d.tmp	VirtualDVD.exe
PID 1412 wrote to memory of 980	1412	d.tmp	VirtualDVD.exe
PID 1412 wrote to memory of 980	1412	d.tmp	VirtualDVD.exe
PID 1412 wrote to memory of 980	1412	d.tmp	VirtualDVD.exe

C:\Users\Admin\AppData\Local\Temp\d.exe
"C:\Users\Admin\AppData\Local\Temp\d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Local\Temp\is-LMPOK.tmp\d.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LMPOK.tmp\d.tmp" /SL5="$400CE,11195346,152064,C:\Users\Admin\AppData\Local\Temp\d.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1412

C:\Program Files (x86)\VirtualDVD\wmfdist.exe
"C:\Program Files (x86)\VirtualDVD\wmfdist.exe" /Q:A /R:N
3⤵
- Executes dropped EXE
PID:1700

C:\Program Files (x86)\VirtualDVD\VirtualDVD.exe
"C:\Program Files (x86)\VirtualDVD\VirtualDVD.exe" d.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\VirtualDVD\VirtualDVD.exe
MD5
1fa52992c9660ebae3cc45fed5ceb954

SHA1
9dc8b2c175c8589249a37570b3d97400b378d4d4

SHA256
4c3ed3b5ef6fea99e221244722f8bb22d5cbc48630de245e77862b06ac38d41d

SHA512
9dbec1837ce44d7939ae389beacc2752ec62a2c801cdebd5a6e4aaf50432d413decc8d76c3355727054427fcaaf342dc973c6d1190e9ed9ea815e681c2cbf626

Download Submit
C:\Program Files (x86)\VirtualDVD\sqlite3.dll
MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
C:\Program Files (x86)\VirtualDVD\wmfdist.exe
MD5
f59090e9a8070d7fbbdcc8895d2169a3

SHA1
370e62290cac6a6c7aa13442741caf6671437a54

SHA256
a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

SHA512
45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

Download Submit
C:\Program Files (x86)\VirtualDVD\wmfdist.exe
MD5
f59090e9a8070d7fbbdcc8895d2169a3

SHA1
370e62290cac6a6c7aa13442741caf6671437a54

SHA256
a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

SHA512
45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LMPOK.tmp\d.tmp
MD5
f8e6e1e60627e386ff31720968c1ec4e

SHA1
381ad224413a1c10fff08c718e162a3af8e34730

SHA256
a44ff663cb039bedd656e9f0576d763c897fcd41912601525fbec0244ebd36e1

SHA512
d53cc47c976e5c265156e815a566bb7e81046cd53f0b9da64d228725b4616c8be381472b61fad566a666f042b77f5294be2edbbbab0d5521c6867d55607823e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LMPOK.tmp\d.tmp
MD5
f8e6e1e60627e386ff31720968c1ec4e

SHA1
381ad224413a1c10fff08c718e162a3af8e34730

SHA256
a44ff663cb039bedd656e9f0576d763c897fcd41912601525fbec0244ebd36e1

SHA512
d53cc47c976e5c265156e815a566bb7e81046cd53f0b9da64d228725b4616c8be381472b61fad566a666f042b77f5294be2edbbbab0d5521c6867d55607823e7

Download Submit
\Program Files (x86)\VirtualDVD\VirtualDVD.exe
MD5
1fa52992c9660ebae3cc45fed5ceb954

SHA1
9dc8b2c175c8589249a37570b3d97400b378d4d4

SHA256
4c3ed3b5ef6fea99e221244722f8bb22d5cbc48630de245e77862b06ac38d41d

SHA512
9dbec1837ce44d7939ae389beacc2752ec62a2c801cdebd5a6e4aaf50432d413decc8d76c3355727054427fcaaf342dc973c6d1190e9ed9ea815e681c2cbf626

Download Submit
\Program Files (x86)\VirtualDVD\sqlite3.dll
MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
\Program Files (x86)\VirtualDVD\unins000.exe
MD5
76e2c5cacbab1239a96d02f2b30f15ea

SHA1
17a9692fd01e6edc6ff6c8e0490be7ab223bd3c8

SHA256
71e7b3cf578ae289caa9e7cd66fdde49d0b4e004520bef73a643048461a411de

SHA512
338ec0ccbe819d8cd6b55e5aa60d939b82d16f97c5bcf5e3782eefac29f2b2d7bb6114f5746518e080b655c0a5a1cf4733480cf7a64f0140b729be1a5b8fa70b

Download Submit
\Program Files (x86)\VirtualDVD\wmfdist.exe
MD5
f59090e9a8070d7fbbdcc8895d2169a3

SHA1
370e62290cac6a6c7aa13442741caf6671437a54

SHA256
a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

SHA512
45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

Download Submit
\Users\Admin\AppData\Local\Temp\is-2DM3Q.tmp\_isetup\_iscrypt.dll
MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-2DM3Q.tmp\_isetup\_shfoldr.dll
MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-2DM3Q.tmp\_isetup\_shfoldr.dll
MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-LMPOK.tmp\d.tmp
MD5
f8e6e1e60627e386ff31720968c1ec4e

SHA1
381ad224413a1c10fff08c718e162a3af8e34730

SHA256
a44ff663cb039bedd656e9f0576d763c897fcd41912601525fbec0244ebd36e1

SHA512
d53cc47c976e5c265156e815a566bb7e81046cd53f0b9da64d228725b4616c8be381472b61fad566a666f042b77f5294be2edbbbab0d5521c6867d55607823e7

Download Submit
memory/980-44-0x0000000000000000-mapping.dmp

Download
memory/1412-1-0x0000000000000000-mapping.dmp

Download
memory/1700-40-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads