7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843

Analysis

max time kernel
101s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
Size

252KB
MD5

23ab9578a1125870f23227170f47322b
SHA1

b922d35624447cac1f820c49c7f1cb7463cf760f
SHA256

7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843
SHA512

54c07a5504de191025331a1c3c6684212e846b2f7d8cf4cae7a7b43f612e846fa337cafba4fc161debfb02aa67f974d47eb1ba5618471704faac3baaf8733bad
SSDEEP

6144:OmeXM4HzkDBcLvVLNzti4zkq+UX7MezRnjV:3eJHzkyZuUX7M4RjV

Score

8^/10

vmprotect

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1480	update.exe
1220	盘龙.exe

VMProtect packed file 10 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0004000000019423-63.dat	vmprotect
behavioral1/files/0x0004000000019423-64.dat	vmprotect
behavioral1/files/0x0004000000019423-66.dat	vmprotect
behavioral1/files/0x0004000000019423-65.dat	vmprotect
behavioral1/files/0x0004000000019423-68.dat	vmprotect
behavioral1/files/0x0004000000019423-70.dat	vmprotect
behavioral1/memory/1220-71-0x0000000000400000-0x0000000000CC4000-memory.dmp	vmprotect
behavioral1/memory/1220-74-0x0000000000400000-0x0000000000CC4000-memory.dmp	vmprotect
behavioral1/memory/1220-76-0x0000000000400000-0x0000000000CC4000-memory.dmp	vmprotect
behavioral1/memory/1220-78-0x0000000000400000-0x0000000000CC4000-memory.dmp	vmprotect

Loads dropped DLL 5 IoCs

pid	Process
764	cmd.exe
1480	update.exe
1480	update.exe
1480	update.exe
1480	update.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1220	盘龙.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = a803000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	盘龙.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	盘龙.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	盘龙.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1600	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1220	盘龙.exe
1220	盘龙.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	900	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
900	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
900	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
1220	盘龙.exe
1220	盘龙.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 764	900	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe	29
PID 900 wrote to memory of 764	900	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe	29
PID 900 wrote to memory of 764	900	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe	29
PID 900 wrote to memory of 764	900	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe	29
PID 900 wrote to memory of 764	900	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe	29
PID 900 wrote to memory of 764	900	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe	29
PID 900 wrote to memory of 764	900	7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe	29
PID 764 wrote to memory of 1600	764	cmd.exe	31
PID 764 wrote to memory of 1600	764	cmd.exe	31
PID 764 wrote to memory of 1600	764	cmd.exe	31
PID 764 wrote to memory of 1600	764	cmd.exe	31
PID 764 wrote to memory of 1480	764	cmd.exe	32
PID 764 wrote to memory of 1480	764	cmd.exe	32
PID 764 wrote to memory of 1480	764	cmd.exe	32
PID 764 wrote to memory of 1480	764	cmd.exe	32
PID 764 wrote to memory of 1480	764	cmd.exe	32
PID 764 wrote to memory of 1480	764	cmd.exe	32
PID 764 wrote to memory of 1480	764	cmd.exe	32
PID 1480 wrote to memory of 1220	1480	update.exe	33
PID 1480 wrote to memory of 1220	1480	update.exe	33
PID 1480 wrote to memory of 1220	1480	update.exe	33
PID 1480 wrote to memory of 1220	1480	update.exe	33
PID 1480 wrote to memory of 1220	1480	update.exe	33
PID 1480 wrote to memory of 1220	1480	update.exe	33
PID 1480 wrote to memory of 1220	1480	update.exe	33

C:\Users\Admin\AppData\Local\Temp\7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe
"C:\Users\Admin\AppData\Local\Temp\7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" C:\Users\Admin\AppData\Local\Temp\7bb53a5b0faa20860d420d14d254ce82adc1c0db8571950c3698e54866ba5843.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\PING.EXE
    ping 1 -n 1 -w 500
    3⤵
    - Runs ping.exe
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\update.exe
    update.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\盘龙\盘龙.exe
      "C:\盘龙\盘龙.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0LYNQJM7\v[1].htm

Filesize
69B

MD5
7db3d4c2e77fe0b10ca60db0c08b2906

SHA1
dd022642eeb0ea9e22e0bea01ae6f163db4195c1

SHA256
743f39de60f8f63a5abeff5ec83f528e44605fd9e1ad48cb18efcb7ac15c96d7

SHA512
f08e7d2511daf0c8e2f896c557b96769fdd1c36938d3d64e9a3f493089c4e061023e7d59b56822144db36ce1cde4c453115ef210adead41cf8c5bd022f2a5097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MK8YK3QV\v[1].htm

Filesize
69B

MD5
56b9d6b988cb0b20fce4b607c83eb019

SHA1
dfeafbc716a728150a9d0e7e594ecd8d3cfdb054

SHA256
22f1cb52301a3ddb1a28b8e361871526a60a85302da58d36f91e76de646c4c1e

SHA512
e840270a268949dea4594b0f6db6d7b33a21bfd79470a37a3f3088cecd3d4750656c72977f64103b430fc0c2fb75f2f66258830cd849971adb8e01d06b8930e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.bat

Filesize
84B

MD5
75af5ae35376f9e4b9de7dc23d0404ae

SHA1
e0f244fe77314c41156b5a04422ed1da4ebfa4d2

SHA256
2d6720f69921aa23d0b089e3b9504c8ae41c2092ad0a65cc3343649e11709f80

SHA512
ed2c7a9bee9067d8763ae0f9b96fbacf0fba6727d8b8782d3de6977574163547bad6ee9495c78b2fd2f5cc7e36d9fa526a41f7b33d2a769749ce8431c0281498

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.exe

Filesize
16.7MB

MD5
d134ee589e8bf4f8b5ff391ce0b1084a

SHA1
1d43783c03e3ae20ed6aaa6c17fc15772c65169a

SHA256
d06d8a664a4f5b3ba9d91b5d1c54b1f8fc757348bda98343b683c18b16df0268

SHA512
2af8654dd305feae8e364e43da323c340b50516767e913e409f2516fb6ff95683049669894ae66aa1441cdd4d285ce522bea23c9290376022e0651cf23b2a71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.exe

Filesize
16.7MB

MD5
d134ee589e8bf4f8b5ff391ce0b1084a

SHA1
1d43783c03e3ae20ed6aaa6c17fc15772c65169a

SHA256
d06d8a664a4f5b3ba9d91b5d1c54b1f8fc757348bda98343b683c18b16df0268

SHA512
2af8654dd305feae8e364e43da323c340b50516767e913e409f2516fb6ff95683049669894ae66aa1441cdd4d285ce522bea23c9290376022e0651cf23b2a71d

Download Submit
C:\盘龙\盘龙.exe

Filesize
5.3MB

MD5
0b7ff2f76373383235821435118b23e6

SHA1
554158f9dec603b98be7c24fc5f7cb1c72e6de2e

SHA256
d522f7fd0ffe546c28b5423c60329e1034285b6788a01853f9220c7b28212410

SHA512
ca00329b173f5f924735a7b695b111bc90b094fd603a7be1098a507252348254d082aac34868160cca876dbca5f4fed666f519cee0de4c752e82864dd754b4e2

Download Submit
C:\盘龙\盘龙.exe

Filesize
5.3MB

MD5
0b7ff2f76373383235821435118b23e6

SHA1
554158f9dec603b98be7c24fc5f7cb1c72e6de2e

SHA256
d522f7fd0ffe546c28b5423c60329e1034285b6788a01853f9220c7b28212410

SHA512
ca00329b173f5f924735a7b695b111bc90b094fd603a7be1098a507252348254d082aac34868160cca876dbca5f4fed666f519cee0de4c752e82864dd754b4e2

Download Submit
\Users\Admin\AppData\Local\Temp\update.exe

Filesize
16.7MB

MD5
d134ee589e8bf4f8b5ff391ce0b1084a

SHA1
1d43783c03e3ae20ed6aaa6c17fc15772c65169a

SHA256
d06d8a664a4f5b3ba9d91b5d1c54b1f8fc757348bda98343b683c18b16df0268

SHA512
2af8654dd305feae8e364e43da323c340b50516767e913e409f2516fb6ff95683049669894ae66aa1441cdd4d285ce522bea23c9290376022e0651cf23b2a71d

Download Submit
\盘龙\盘龙.exe

Filesize
5.3MB

MD5
0b7ff2f76373383235821435118b23e6

SHA1
554158f9dec603b98be7c24fc5f7cb1c72e6de2e

SHA256
d522f7fd0ffe546c28b5423c60329e1034285b6788a01853f9220c7b28212410

SHA512
ca00329b173f5f924735a7b695b111bc90b094fd603a7be1098a507252348254d082aac34868160cca876dbca5f4fed666f519cee0de4c752e82864dd754b4e2

Download Submit
\盘龙\盘龙.exe

Filesize
5.3MB

MD5
0b7ff2f76373383235821435118b23e6

SHA1
554158f9dec603b98be7c24fc5f7cb1c72e6de2e

SHA256
d522f7fd0ffe546c28b5423c60329e1034285b6788a01853f9220c7b28212410

SHA512
ca00329b173f5f924735a7b695b111bc90b094fd603a7be1098a507252348254d082aac34868160cca876dbca5f4fed666f519cee0de4c752e82864dd754b4e2

Download Submit
\盘龙\盘龙.exe

Filesize
5.3MB

MD5
0b7ff2f76373383235821435118b23e6

SHA1
554158f9dec603b98be7c24fc5f7cb1c72e6de2e

SHA256
d522f7fd0ffe546c28b5423c60329e1034285b6788a01853f9220c7b28212410

SHA512
ca00329b173f5f924735a7b695b111bc90b094fd603a7be1098a507252348254d082aac34868160cca876dbca5f4fed666f519cee0de4c752e82864dd754b4e2

Download Submit
\盘龙\盘龙.exe

Filesize
5.3MB

MD5
0b7ff2f76373383235821435118b23e6

SHA1
554158f9dec603b98be7c24fc5f7cb1c72e6de2e

SHA256
d522f7fd0ffe546c28b5423c60329e1034285b6788a01853f9220c7b28212410

SHA512
ca00329b173f5f924735a7b695b111bc90b094fd603a7be1098a507252348254d082aac34868160cca876dbca5f4fed666f519cee0de4c752e82864dd754b4e2

Download Submit
memory/900-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1220-71-0x0000000000400000-0x0000000000CC4000-memory.dmp

Filesize
8.8MB

Download
memory/1220-74-0x0000000000400000-0x0000000000CC4000-memory.dmp

Filesize
8.8MB

Download
memory/1220-76-0x0000000000400000-0x0000000000CC4000-memory.dmp

Filesize
8.8MB

Download
memory/1220-78-0x0000000000400000-0x0000000000CC4000-memory.dmp

Filesize
8.8MB

Download