ef1c7df22e071bd236cff6de972f281c9db53e4f247be4cfd341777c03277108

Analysis

max time kernel
74s
max time network
35s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install.exe
Size

686.7MB
MD5

27653c835f31dcb8aca420f8ef5eb421
SHA1

fe3353e2257cfab6b6320db281acd67702131486
SHA256

80a1fc5830602b1c5ec1fa6439c3b4189558fd4deaa175e732de9f956ddf55c2
SHA512

2149f983b7e4bd123917beb324a8d5b7d60acd718c675a176939378901f5c98ac2b652ec2c095ce723d4de00350c5f9806b1d5a3b8467106075bc8ecf615b879
SSDEEP

98304:kKiI2ZBtRK7IF1RXsMfWMIl6a6KLmKF0rVKwK8kuvG:r2p7OqWRsa6KKKFGRK8dG

Score

8^/10

spyware stealer vmprotect

Malware Config

Signatures

Downloads MZ/PE file

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
\Users\Admin\Pictures\Minor Policy\jpTBzy5bFOBkF4ObXfx38qAX.exe	vmprotect

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Install.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation Install.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ipinfo.io
1 ipinfo.io

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation	Install.exe

flow	ioc
2	ipinfo.io
1	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

Install.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	Install.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	Install.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Install.exe

pid process

280 Install.exe

pid	process
280	Install.exe

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:280

C:\Users\Admin\Pictures\Minor Policy\jpTBzy5bFOBkF4ObXfx38qAX.exe
"C:\Users\Admin\Pictures\Minor Policy\jpTBzy5bFOBkF4ObXfx38qAX.exe"
2⤵
PID:1092

C:\Users\Admin\Pictures\Minor Policy\YYAXTYzJhCWtJojSHbpdzVU_.exe
"C:\Users\Admin\Pictures\Minor Policy\YYAXTYzJhCWtJojSHbpdzVU_.exe"
2⤵
PID:608

C:\Users\Admin\Pictures\Minor Policy\cE148tWwVAAqV4PhUve8Khjh.exe
"C:\Users\Admin\Pictures\Minor Policy\cE148tWwVAAqV4PhUve8Khjh.exe"
2⤵
PID:364

C:\Users\Admin\Pictures\Minor Policy\sHDH7HQLVRDXQyFv7pQEjLY0.exe
"C:\Users\Admin\Pictures\Minor Policy\sHDH7HQLVRDXQyFv7pQEjLY0.exe"
2⤵
PID:1252

C:\Users\Admin\Pictures\Minor Policy\ALhaTra24vA_V61Wdxt9TfVD.exe
"C:\Users\Admin\Pictures\Minor Policy\ALhaTra24vA_V61Wdxt9TfVD.exe"
2⤵
PID:580

C:\Users\Admin\Pictures\Minor Policy\AO1w_fvnNZlo5g5LNrbcmlnO.exe
"C:\Users\Admin\Pictures\Minor Policy\AO1w_fvnNZlo5g5LNrbcmlnO.exe"
2⤵
PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Pictures\Minor Policy\jpTBzy5bFOBkF4ObXfx38qAX.exe

Download Submit
\Users\Admin\Pictures\Minor Policy\YYAXTYzJhCWtJojSHbpdzVU_.exe

Download Submit
\Users\Admin\Pictures\Minor Policy\YYAXTYzJhCWtJojSHbpdzVU_.exe

Download Submit
\Users\Admin\Pictures\Minor Policy\cE148tWwVAAqV4PhUve8Khjh.exe

Download Submit
\Users\Admin\Pictures\Minor Policy\jpTBzy5bFOBkF4ObXfx38qAX.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\Pictures\Minor Policy\jpTBzy5bFOBkF4ObXfx38qAX.exe
Filesize
92KB

MD5
67996645ca387d6882202a1f270786ba

SHA1
2465dbec654691f4543d8f31729b936c76b7d8a5

SHA256
03d6a765cc1e859b6cea49aa27a62c2c8ea5dd12a5b2cf4e769470c8b45f8f86

SHA512
c2c475cda1e6a468ed7a09da6ad944989a82b7c5678fb82842ac9f8c225d20943842e18c5f7a6bbeb3ab107b6d4474135f21fb67c9d637f2a02c1440dfedb2e0

Download Submit
\Users\Admin\Pictures\Minor Policy\sHDH7HQLVRDXQyFv7pQEjLY0.exe

Download Submit
memory/280-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/280-55-0x0000000001270000-0x0000000001B2B000-memory.dmp

Filesize
8.7MB

Download
memory/280-64-0x0000000003140000-0x0000000003167000-memory.dmp

Filesize
156KB

Download
memory/608-61-0x0000000000000000-mapping.dmp

Download
memory/1092-63-0x0000000000000000-mapping.dmp

Download