861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c

General

Target

861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe
Size

4.1MB
MD5

128c988e53b8ccfabb3e5b7c28aa5e09
SHA1

7ddfaf0ce5a362e950ba31ab3361a5d12904b041
SHA256

861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c
SHA512

6279585c4403a53ee4e20165d905c3394e71791d62e87c1a2a68414fdba98b190694cdf33951d64471c0f68be0dc8c9bbb7736a6ae574e78d2e0965b5002dda3
SSDEEP

98304:PiHByZAGYNaIIEzjqzKZA5VZTRLzMeBm0QhbY:QByZZFIIHKK5LT5MeYjY

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
5032	Internetexplorervps.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Wine	Internetexplorervps.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Wine	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flaiԪmacijnfigbb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Internetexplorervps.exe"	Internetexplorervps.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4612	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe
5032	Internetexplorervps.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
620	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4612	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe
4612	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe
5032	Internetexplorervps.exe
5032	Internetexplorervps.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5032	Internetexplorervps.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 5032	4612	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe	81
PID 4612 wrote to memory of 5032	4612	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe	81
PID 4612 wrote to memory of 5032	4612	861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe	81
PID 5032 wrote to memory of 4940	5032	Internetexplorervps.exe	82
PID 5032 wrote to memory of 4940	5032	Internetexplorervps.exe	82
PID 5032 wrote to memory of 4940	5032	Internetexplorervps.exe	82
PID 4940 wrote to memory of 620	4940	CMD.EXE	84
PID 4940 wrote to memory of 620	4940	CMD.EXE	84
PID 4940 wrote to memory of 620	4940	CMD.EXE	84

C:\Users\Admin\AppData\Local\Temp\861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe
"C:\Users\Admin\AppData\Local\Temp\861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c.exe"
1⤵
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\Internetexplorervps.exe
  "C:\Users\Admin\AppData\Local\Temp\Internetexplorervps.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\CMD.EXE
    CMD.EXE /c REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Internetexplorervps.exe

Filesize
4.1MB

MD5
128c988e53b8ccfabb3e5b7c28aa5e09

SHA1
7ddfaf0ce5a362e950ba31ab3361a5d12904b041

SHA256
861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c

SHA512
6279585c4403a53ee4e20165d905c3394e71791d62e87c1a2a68414fdba98b190694cdf33951d64471c0f68be0dc8c9bbb7736a6ae574e78d2e0965b5002dda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Internetexplorervps.exe

Filesize
4.1MB

MD5
128c988e53b8ccfabb3e5b7c28aa5e09

SHA1
7ddfaf0ce5a362e950ba31ab3361a5d12904b041

SHA256
861d9d7933c4c6fa8723894c2009bfd0801e2f049184631a515d84bcf57ffe5c

SHA512
6279585c4403a53ee4e20165d905c3394e71791d62e87c1a2a68414fdba98b190694cdf33951d64471c0f68be0dc8c9bbb7736a6ae574e78d2e0965b5002dda3

Download Submit
memory/4612-132-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/4612-133-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/4612-137-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/5032-138-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/5032-141-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/5032-142-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download
memory/5032-143-0x0000000000400000-0x0000000000B33000-memory.dmp

Filesize
7.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads