f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d

Analysis

max time kernel
173s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe
Size

180KB
MD5

4eb216d0cdff53fc37e2e97d585bc500
SHA1

fdbb10b5baea73cd3c594ce7455f66ceed56dfe3
SHA256

f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d
SHA512

8f5fee67ebfb4b01d70760a9701528d4ad923d72317691578ff3962318eda1854c12ab2fae5ca9f4b645d607d0fa73d9bbcaaa58a00e663f81b6f5ad69b2d885
SSDEEP

3072:zDy10WbcVmYqr4DbbFD4SCW4vs992l77fQjmhBKINClpvV5YW3A:znycVxqMDbbFDhCW4C92lHf8mhBKIwlc

Score

10^/10

evasion trojan vmprotect

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/4956-132-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect
behavioral2/memory/4956-133-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect
behavioral2/memory/4956-134-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

Processes:

f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe

description ioc process

File created C:\Windows\SysWOW64\test.dat f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe

pid process

4956 f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\test.dat	f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe

pid	process
4956	f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe

C:\Users\Admin\AppData\Local\Temp\f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe
"C:\Users\Admin\AppData\Local\Temp\f1fcefdb444af1abb7e53f9b0872bd63af5eab8c0ec414793c7b4255fe3a859d.exe"
1⤵
- UAC bypass
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System policy modification
PID:4956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4956-132-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4956-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4956-134-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download