6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe
Size

88KB
MD5

40c4a6f1ecab4462dd086731cb551ee2
SHA1

40c2130399c50a697488f4503ba4f647373c0206
SHA256

6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08
SHA512

ce0cefd14164e696ec073760c9e19e6853a50c6a3ccda94555024d35e23a744f4e37b15759383753ab729b8165ecf57f7f19471f9e8e989b70c797a9bd60dde5
SSDEEP

1536:dXNXdlRH+Dwk4cSGesvhC8plnQ85+HwClgfTQqPTFTCtOQ8CcfiQ:ddtlRH+UxGzh3HQ85+QqoTBfiQ

Score

8^/10

bootkit persistence vmprotect

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1236	svchosts.exe

VMProtect packed file 7 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/892-54-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect
behavioral1/memory/892-57-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect
behavioral1/files/0x00140000000054ab-59.dat	vmprotect
behavioral1/memory/1236-60-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect
behavioral1/memory/1236-67-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect
behavioral1/memory/892-68-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect
behavioral1/memory/892-70-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\svchosts.exe	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe
File opened for modification	C:\windows\svchosts.exe	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000e2be607c77191ac0339d73d73782248f7940c00f2ca9b78989a75a30c362b19e000000000e80000000020000200000003ccddd90406ddb4e062053b9fce273c9b9227eff0ac0ac32a6aeee259973875390000000e146c25c5a85b7d6d6d3c72ad66c5026385c31d3bcd69ca2e1a22af45eb3133ea54d5800c018771c8fc2c063d2e34f4c20a3872cd0f5ad8c74016e1857936da3a13db85c232551414e79285841231cde3c8c54d8c45191d36884b3b4c05ebf6fc2818c8e6552e047bf781f38c4b88046f35574b4587c7fb07c101d372e63c3edd9ce5918d0c300ec823dc3c22c234ece40000000aea76934531063f1af3b637ecdd2e4124a70bb2fe5949dd047086326e5051374418872778d6acf2402d5f7ef3b0cba74680966075c8cd6cf703839bfdeae4a2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c19a18f9cbd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370337307"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000003ad702bea36e3c5e768dfc96ad9197df35531153e1fa8ef770533d3b89eadcc000000000e8000000002000020000000164ac406d41287ed38f87b0a2f8a9ebf7921d586655bf3e7b8eac96f230b8bcc200000000fc26abc3a70ec35e8ee1d3e20596622881dfc5861ecfe5a8e7ca600a3ed11da40000000ab71595fb525ab1d3e81d6a473a3f4d667d7a74401f6f10e82b37e0d61a3b9fbab9cf9e00877e3f82dca616577aa69a8f8690260e05e857553623a197bbe2930	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E3391D1-37EC-11ED-BF3D-D6AAFEFD221A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
892	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1336	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
892	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe
1236	svchosts.exe
1336	iexplore.exe
1336	iexplore.exe
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1236	892	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe	27
PID 892 wrote to memory of 1236	892	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe	27
PID 892 wrote to memory of 1236	892	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe	27
PID 892 wrote to memory of 1236	892	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe	27
PID 892 wrote to memory of 1336	892	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe	28
PID 892 wrote to memory of 1336	892	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe	28
PID 892 wrote to memory of 1336	892	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe	28
PID 892 wrote to memory of 1336	892	6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe	28
PID 1336 wrote to memory of 1496	1336	iexplore.exe	30
PID 1336 wrote to memory of 1496	1336	iexplore.exe	30
PID 1336 wrote to memory of 1496	1336	iexplore.exe	30
PID 1336 wrote to memory of 1496	1336	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe
"C:\Users\Admin\AppData\Local\Temp\6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
- C:\windows\svchosts.exe
  C:\windows\svchosts.exe auto
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1236
- C:\progra~1\Intern~1\iexplore.exe
  C:\\progra~1\\Intern~1\\iexplore.exe http://jianqiangzhe1.com/AddSetup.asp?id=137&localID=QM00013&isqq=3
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6VDJ5BZJ.txt

Filesize
599B

MD5
972f83524898a1b4edc5d4528a29f94b

SHA1
2da79da46683406d3c5b2044cd604fc6ffdef44e

SHA256
06ebf6b12fd2bb0b1fc3b429d19eb0c6427c377388667c84d7d5113a0172d62d

SHA512
5ba0d6b14da614d0a3646db48b17160c864963742bf85815b383a46057000bb254d1c4f810c3afb73fc42c40d98ec9ed533585d34436d43c92539914212ae3ca

Download Submit
C:\Windows\svchosts.exe

Filesize
88KB

MD5
40c4a6f1ecab4462dd086731cb551ee2

SHA1
40c2130399c50a697488f4503ba4f647373c0206

SHA256
6e303601af3f39756e878c1014eea78f0f89542783ee1ef02dbe66b54b154f08

SHA512
ce0cefd14164e696ec073760c9e19e6853a50c6a3ccda94555024d35e23a744f4e37b15759383753ab729b8165ecf57f7f19471f9e8e989b70c797a9bd60dde5

Download Submit
memory/892-64-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/892-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/892-66-0x00000000002B0000-0x00000000002E1000-memory.dmp

Filesize
196KB

Download
memory/892-65-0x00000000002B0000-0x00000000002E1000-memory.dmp

Filesize
196KB

Download
memory/892-68-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/892-69-0x00000000002B0000-0x00000000002E1000-memory.dmp

Filesize
196KB

Download
memory/892-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/892-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1236-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1236-67-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download