Analysis
-
max time kernel
187s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:40
Static task
static1
Behavioral task
behavioral1
Sample
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe
Resource
win10v2004-20221111-en
General
-
Target
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe
-
Size
76KB
-
MD5
8361b14c9b5bbafcbed5e5327f06b514
-
SHA1
6445921742db078e4369aa951b097928b4b7246d
-
SHA256
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3
-
SHA512
b5b5ccc59f7931e8613225f06ce6a6079f9ea973ae1b1f2ce914f043ed88d3851d14cebbe16233c401f0f934fcb41899fff721f599dfb353840c82d6fd97fe8b
-
SSDEEP
768:uembNRqsuhlGO6rhgFwumSCbxTGy/BBGg4NKJJKqUThbJ32+ve7i40vN0TlT+Xk+:cnqcu3abBGy3G8V0iuo2j
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 2 IoCs
Processes:
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exevcn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt vcn.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
Processes:
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exevcn.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" vcn.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exevcn.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vcn.exe -
Executes dropped EXE 1 IoCs
Processes:
vcn.exepid process 1644 vcn.exe -
Loads dropped DLL 2 IoCs
Processes:
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exepid process 2008 e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe 2008 e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
vcn.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run vcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm" vcn.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vcn.exedescription ioc process File opened (read-only) \??\E: vcn.exe File opened (read-only) \??\M: vcn.exe File opened (read-only) \??\S: vcn.exe File opened (read-only) \??\V: vcn.exe File opened (read-only) \??\P: vcn.exe File opened (read-only) \??\Y: vcn.exe File opened (read-only) \??\I: vcn.exe File opened (read-only) \??\K: vcn.exe File opened (read-only) \??\N: vcn.exe File opened (read-only) \??\O: vcn.exe File opened (read-only) \??\T: vcn.exe File opened (read-only) \??\U: vcn.exe File opened (read-only) \??\X: vcn.exe File opened (read-only) \??\G: vcn.exe File opened (read-only) \??\H: vcn.exe File opened (read-only) \??\Q: vcn.exe File opened (read-only) \??\R: vcn.exe File opened (read-only) \??\W: vcn.exe File opened (read-only) \??\Z: vcn.exe File opened (read-only) \??\B: vcn.exe File opened (read-only) \??\F: vcn.exe File opened (read-only) \??\J: vcn.exe File opened (read-only) \??\L: vcn.exe -
Drops file in System32 directory 6 IoCs
Processes:
vcn.exee454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exedescription ioc process File created \??\c:\windows\SysWOW64\Desktop.sysm vcn.exe File created \??\c:\windows\SysWOW64\CommandPrompt.Sysm vcn.exe File created \??\c:\windows\SysWOW64\maxtrox.txt e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe File created \??\c:\windows\SysWOW64\Windows 3D.scr e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe File opened for modification \??\c:\windows\SysWOW64\maxtrox.txt vcn.exe File opened for modification \??\c:\windows\SysWOW64\Windows 3D.scr vcn.exe -
Drops file in Program Files directory 35 IoCs
Processes:
vcn.exedescription ioc process File opened for modification \??\c:\Program Files\Internet Explorer\iediagcmd.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Journal\PDIALOG.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnetwk.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmplayer.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Sidebar\sidebar.exe vcn.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.exe vcn.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpenc.exe vcn.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.exe vcn.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe vcn.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe vcn.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPDMC.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmprph.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpshare.exe vcn.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Defender\MpCmdRun.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe vcn.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe vcn.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe vcn.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe vcn.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe vcn.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe vcn.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Mail\wab.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnscfg.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe vcn.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe vcn.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe vcn.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmlaunch.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpconfig.exe vcn.exe File opened for modification \??\c:\Program Files\SuspendCompare.exe vcn.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe vcn.exe File opened for modification \??\c:\Program Files\Windows Defender\MSASCui.exe vcn.exe -
Modifies registry class 36 IoCs
Processes:
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exevcn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1" e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt vcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1" vcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1" vcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt vcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon vcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon vcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe" vcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct" e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe" e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile vcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd vcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe" vcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm vcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command vcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt vcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct" vcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe" e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1" e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic" e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command vcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic" vcn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exevcn.exepid process 2008 e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe 1644 vcn.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exedescription pid process target process PID 2008 wrote to memory of 1644 2008 e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe vcn.exe PID 2008 wrote to memory of 1644 2008 e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe vcn.exe PID 2008 wrote to memory of 1644 2008 e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe vcn.exe PID 2008 wrote to memory of 1644 2008 e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe vcn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe"C:\Users\Admin\AppData\Local\Temp\e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e3.exe"1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\vcn.exe"c:\Documents and Settings\Admin\Application Data\Microsoft\vcn.exe" e454330df4a4f1765173b4249f8128c5ebd8b61a8f6e2bc86f00894b51f114e32⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\vcn.exeFilesize
76KB
MD54b83e02b81df90fea584e31ea827a8c0
SHA179c3e7027fe5d08554afadb260069604691dc5df
SHA2560fd729853d4615c14b1b1c7e82ce82c8a3db3ab73ce4185fd0b60a278419cf92
SHA512ed37b00e7dfebdbd027917db94b5430cd88ceab3893c3433b98c9c7ecf6c277119daeaeef3562a8358761ddbfdb691d3738c19f6555279472cddf49edd5b6f95
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\vcn.exeFilesize
76KB
MD54b83e02b81df90fea584e31ea827a8c0
SHA179c3e7027fe5d08554afadb260069604691dc5df
SHA2560fd729853d4615c14b1b1c7e82ce82c8a3db3ab73ce4185fd0b60a278419cf92
SHA512ed37b00e7dfebdbd027917db94b5430cd88ceab3893c3433b98c9c7ecf6c277119daeaeef3562a8358761ddbfdb691d3738c19f6555279472cddf49edd5b6f95
-
\??\c:\windows\SysWOW64\Windows 3D.scrFilesize
76KB
MD5e5722663c83043a5d429308c38cd834e
SHA11ddaf22c61838dc183d403587f19f8b9b62431a2
SHA256d1dda083cbf5682bf2a89602f20c5509bfdb1a7a32d3e6893c99f0086a56e597
SHA512c934011c841def9fe7d7e695d542fa0b256069df035260271bdfc39912e99d53ec36f1e1feb4dbba74ce95ae1177b4273c7a197144598a7d9495eb7d11ff0c0b
-
\??\c:\windows\SysWOW64\maxtrox.txtFilesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
\Users\Admin\AppData\Roaming\Microsoft\vcn.exeFilesize
76KB
MD54b83e02b81df90fea584e31ea827a8c0
SHA179c3e7027fe5d08554afadb260069604691dc5df
SHA2560fd729853d4615c14b1b1c7e82ce82c8a3db3ab73ce4185fd0b60a278419cf92
SHA512ed37b00e7dfebdbd027917db94b5430cd88ceab3893c3433b98c9c7ecf6c277119daeaeef3562a8358761ddbfdb691d3738c19f6555279472cddf49edd5b6f95
-
\Users\Admin\AppData\Roaming\Microsoft\vcn.exeFilesize
76KB
MD54b83e02b81df90fea584e31ea827a8c0
SHA179c3e7027fe5d08554afadb260069604691dc5df
SHA2560fd729853d4615c14b1b1c7e82ce82c8a3db3ab73ce4185fd0b60a278419cf92
SHA512ed37b00e7dfebdbd027917db94b5430cd88ceab3893c3433b98c9c7ecf6c277119daeaeef3562a8358761ddbfdb691d3738c19f6555279472cddf49edd5b6f95
-
memory/1644-58-0x0000000000000000-mapping.dmp