360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078

General

Target

360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
Size

980KB
MD5

49a240d3c28b2195041134e3746a6b90
SHA1

9b30562b3e3886044e6d0e098e8814ee90a10d11
SHA256

360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078
SHA512

e595cc4fd5ebd614bdcd63f40962c219a042d75ce40dd3d7eab51a58fcd67deaac15ffc616597f7c00943a383b98223f0df4922235baf102cd3e9fe14a5562ac
SSDEEP

24576:9buQmMlRYL7wseSkDHqTNmIhvl1KFJSuDwb9F0mpsA:kIAh8D8cIhvTkJ1Uf

Score

8^/10

vmprotect

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
File created	C:\Windows\System32\drivers\etc\hosts.ics	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1620-54-0x0000000000400000-0x0000000000609000-memory.dmp	vmprotect
behavioral1/memory/1620-56-0x0000000000400000-0x0000000000609000-memory.dmp	vmprotect
behavioral1/memory/1620-58-0x0000000000400000-0x0000000000609000-memory.dmp	vmprotect
behavioral1/memory/1620-68-0x0000000000400000-0x0000000000609000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

732 taskkill.exe
784 taskkill.exe

pid	process
732	taskkill.exe
784	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

RunDll32.exe360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe

pid	process
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

taskkill.exetaskkill.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	732	taskkill.exe
Token: SeDebugPrivilege	784	taskkill.exe
Token: 33	936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	936	AUDIODG.EXE
Token: 33	936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	936	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exeRunDll32.exe

pid process

1620 360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1052 RunDll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe

pid	process
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe

description	pid	process	target process
PID 1620 wrote to memory of 732	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	taskkill.exe
PID 1620 wrote to memory of 732	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	taskkill.exe
PID 1620 wrote to memory of 732	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	taskkill.exe
PID 1620 wrote to memory of 732	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	taskkill.exe
PID 1620 wrote to memory of 1052	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	RunDll32.exe
PID 1620 wrote to memory of 1052	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	RunDll32.exe
PID 1620 wrote to memory of 1052	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	RunDll32.exe
PID 1620 wrote to memory of 1052	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	RunDll32.exe
PID 1620 wrote to memory of 1052	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	RunDll32.exe
PID 1620 wrote to memory of 1052	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	RunDll32.exe
PID 1620 wrote to memory of 1052	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	RunDll32.exe
PID 1620 wrote to memory of 784	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	taskkill.exe
PID 1620 wrote to memory of 784	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	taskkill.exe
PID 1620 wrote to memory of 784	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	taskkill.exe
PID 1620 wrote to memory of 784	1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
"C:\Users\Admin\AppData\Local\Temp\360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe"
1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im lsas.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Windows\SysWOW64\RunDll32.exe
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:1052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im lsas.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-59-0x0000000000000000-mapping.dmp

Download
memory/784-70-0x0000000000000000-mapping.dmp

Download
memory/1052-61-0x0000000000000000-mapping.dmp

Download
memory/1052-66-0x0000000072871000-0x0000000072873000-memory.dmp

Filesize
8KB

Download
memory/1620-54-0x0000000000400000-0x0000000000609000-memory.dmp

Filesize
2.0MB

Download
memory/1620-56-0x0000000000400000-0x0000000000609000-memory.dmp

Filesize
2.0MB

Download
memory/1620-58-0x0000000000400000-0x0000000000609000-memory.dmp

Filesize
2.0MB

Download
memory/1620-60-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1620-67-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download
memory/1620-68-0x0000000000400000-0x0000000000609000-memory.dmp

Filesize
2.0MB

Download
memory/1620-69-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download

pid	process
1620	360d96805b07c95b0ee43417c2baee4b66adf4deddc563c195b85025c9c79078.exe
1052	RunDll32.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads