861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c

General

Target

861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe
Size

4.1MB
MD5

128c988e53b8ccfabb3e5b7c28aa5e09
SHA1

7ddfaf0ce5a362e950ba31ab3361a5d12904b041
SHA256

861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c
SHA512

6279585c4403a53ee4e20165d905c3394e71791d62e87c1a2a68414fdba98b190694cdf33951d64471c0f68be0dc8c9bbb7736a6ae574e78d2e0965b5002dda3
SSDEEP

98304:PiHByZAGYNaIIEzjqzKZA5VZTRLzMeBm0QhbY:QByZZFIIHKK5LT5MeYjY

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
564	Internetexplorervps.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine	Internetexplorervps.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe

Loads dropped DLL 1 IoCs

pid	Process
1000	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\hefmllgnaihgӖfak = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Internetexplorervps.exe"	Internetexplorervps.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1000	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe
564	Internetexplorervps.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1952	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1000	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe
564	Internetexplorervps.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
564	Internetexplorervps.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 564	1000	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe	27
PID 1000 wrote to memory of 564	1000	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe	27
PID 1000 wrote to memory of 564	1000	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe	27
PID 1000 wrote to memory of 564	1000	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe	27
PID 564 wrote to memory of 1804	564	Internetexplorervps.exe	28
PID 564 wrote to memory of 1804	564	Internetexplorervps.exe	28
PID 564 wrote to memory of 1804	564	Internetexplorervps.exe	28
PID 564 wrote to memory of 1804	564	Internetexplorervps.exe	28
PID 1804 wrote to memory of 1952	1804	CMD.EXE	30
PID 1804 wrote to memory of 1952	1804	CMD.EXE	30
PID 1804 wrote to memory of 1952	1804	CMD.EXE	30
PID 1804 wrote to memory of 1952	1804	CMD.EXE	30

C:\Users\Admin\AppData\Local\Temp\861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe
"C:\Users\Admin\AppData\Local\Temp\861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\Internetexplorervps.exe
  "C:\Users\Admin\AppData\Local\Temp\Internetexplorervps.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\CMD.EXE
    CMD.EXE /c REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Internetexplorervps.exe

Filesize
4.1MB

MD5
128c988e53b8ccfabb3e5b7c28aa5e09

SHA1
7ddfaf0ce5a362e950ba31ab3361a5d12904b041

SHA256
861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c

SHA512
6279585c4403a53ee4e20165d905c3394e71791d62e87c1a2a68414fdba98b190694cdf33951d64471c0f68be0dc8c9bbb7736a6ae574e78d2e0965b5002dda3

Download Submit
\Users\Admin\AppData\Local\Temp\Internetexplorervps.exe

Filesize
4.1MB

MD5
128c988e53b8ccfabb3e5b7c28aa5e09

SHA1
7ddfaf0ce5a362e950ba31ab3361a5d12904b041

SHA256
861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c

SHA512
6279585c4403a53ee4e20165d905c3394e71791d62e87c1a2a68414fdba98b190694cdf33951d64471c0f68be0dc8c9bbb7736a6ae574e78d2e0965b5002dda3

Download Submit
memory/564-62-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/564-68-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/564-67-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/564-66-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/1000-60-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/1000-61-0x0000000006230000-0x0000000006963000-memory.dmp

Filesize
7.2MB

Download
memory/1000-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/1000-56-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/1000-55-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads