Analysis
-
max time kernel
370s -
max time network
331s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
02-02-2022 04:34
General
-
Target
venecrypt.exe
-
Size
9.1MB
-
MD5
96b561c72edc125a84af4bf37192b675
-
SHA1
b59d17885948d4de933a8d727a00ed020829ffc0
-
SHA256
79bd4886bde18afe23cc54920491023a659ed849d31e1c73155f810909995329
-
SHA512
bb61cd8c58620bfb50bb0b25fe3ca1573d7e158f79cd5d9af61f03a207e2e1e2e43fa823b26625252856bb3b10b9ae973a70d1ebe5df2b71431d9cd3641b9809
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\venecrypt.exe"C:\Users\Admin\AppData\Local\Temp\venecrypt.exe"1⤵
- Modifies extensions of user files
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2176-130-0x00007FFB00000000-0x00007FFB00002000-memory.dmpFilesize
8KB
-
memory/2176-131-0x00007FFB00030000-0x00007FFB00031000-memory.dmpFilesize
4KB
-
memory/2176-134-0x00007FF65CF90000-0x00007FF65E796000-memory.dmpFilesize
24.0MB
-
memory/2176-135-0x00007FF65CF90000-0x00007FF65E796000-memory.dmpFilesize
24.0MB
-
memory/2176-136-0x0000021CD54A0000-0x0000021CD54A2000-memory.dmpFilesize
8KB
-
memory/2176-137-0x0000021CD54A2000-0x0000021CD54A4000-memory.dmpFilesize
8KB