Analysis
-
max time kernel
606s -
max time network
600s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
02-02-2022 04:34
General
-
Target
venecrypt.exe
-
Size
9.1MB
-
MD5
96b561c72edc125a84af4bf37192b675
-
SHA1
b59d17885948d4de933a8d727a00ed020829ffc0
-
SHA256
79bd4886bde18afe23cc54920491023a659ed849d31e1c73155f810909995329
-
SHA512
bb61cd8c58620bfb50bb0b25fe3ca1573d7e158f79cd5d9af61f03a207e2e1e2e43fa823b26625252856bb3b10b9ae973a70d1ebe5df2b71431d9cd3641b9809
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\venecrypt.exe"C:\Users\Admin\AppData\Local\Temp\venecrypt.exe"1⤵
- Modifies extensions of user files
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x4011⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/604-63-0x0000000002C10000-0x0000000002C20000-memory.dmpFilesize
64KB
-
memory/1032-55-0x0000000000010000-0x00000000000E1000-memory.dmpFilesize
836KB
-
memory/1032-56-0x000007FE80010000-0x000007FE80011000-memory.dmpFilesize
4KB
-
memory/1032-59-0x000000013F8E0000-0x00000001410E6000-memory.dmpFilesize
24.0MB
-
memory/1032-61-0x000000013F8E0000-0x00000001410E6000-memory.dmpFilesize
24.0MB
-
memory/1032-64-0x00000000020C0000-0x00000000020C2000-memory.dmpFilesize
8KB
-
memory/1032-65-0x00000000020C6000-0x00000000020E5000-memory.dmpFilesize
124KB
-
memory/1032-66-0x00000000020E5000-0x00000000020E6000-memory.dmpFilesize
4KB
-
memory/1648-60-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmpFilesize
8KB