090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe
Size

228KB
MD5

6ff71b5c7557f928b4ab7fa2a3bd7dd0
SHA1

6e5200f1fe1fd61b14e4c7f3f1d0026a5f60c1ba
SHA256

090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4
SHA512

9e411e7e05392d10664a6fd6793875925bb3ad527e55fee0a6f909c215cd7f159829f46005684f8ceb5d52e4eaf7041d94f5f0aefcc43ebadb5e2adb0586835f
SSDEEP

6144:tCERXQAAEYLfIWLMQd6o4S8HlcJmcXsIXoK:tCEq7xLM0eSqeJmaDXoK

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1700-54-0x0000000000400000-0x0000000000487000-memory.dmp	vmprotect
behavioral1/memory/1700-60-0x0000000000400000-0x0000000000487000-memory.dmp	vmprotect
behavioral1/memory/1700-62-0x0000000000400000-0x0000000000487000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1700	090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Easypic.bmp	090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe
File opened for modification	C:\Windows\Easypic.bmp	DllHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	DllHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1700	090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe
1700	090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe
1700	090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe

C:\Users\Admin\AppData\Local\Temp\090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe
"C:\Users\Admin\AppData\Local\Temp\090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Easypic.bmp

Filesize
32KB

MD5
eaec51faf05ba0ca10f17a7e855ec99c

SHA1
880afee6517602935e032a4ae0099f23455bf4a9

SHA256
fb6e6fc145cc0aa806c1c599b8f52de3b3a5545f7528cacdc0a9cc55c031e8e7

SHA512
7a31dd71f9fc3e29afa58d5ffc50dc0b62b228372fa189761a9b0b5e94ed9718dacfef5712bcbeccdf6c393fc7ac5c249f5729b517f48e87070ce19ca370ef9a

Download Submit
memory/1700-54-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1700-58-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1700-60-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1700-62-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download