5eadeba25ef4e49920fa50a8015124ea3de3d4ff55996a95835294edb1bf1fb6

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

explorer.exe
Size

359KB
MD5

771b83237080ce84f277b99fc57363e7
SHA1

098b95bf5605af681a1a2e71919c64c86baf4a0b
SHA256

66478e56cae82555807d363e872e8aef552daedbbf2e16238e96e54e950e2e70
SHA512

e66fa464d13088534d9bbaf0748f37708fbf21ec8792fd3c04b2c780ef0257bacbc094552a1af45d5d2880c7f2cd540f6f19176026187254f5d22ec552e2ad1f
SSDEEP

6144:4KIV0ybHaU2lWrt4+gn849gq22v7OMSII+23T1rng22yCsGd90Zgy:0HpYael922v7OnxTlngTnd98p

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/4648-132-0x0000000041700000-0x00000000417A6000-memory.dmp	vmprotect
behavioral2/memory/4648-134-0x0000000041700000-0x00000000417A6000-memory.dmp	vmprotect
behavioral2/memory/4648-135-0x0000000041700000-0x00000000417A6000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\International\CpMRU	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

explorer.exe

pid process

4648 explorer.exe
4648 explorer.exe
4648 explorer.exe
4648 explorer.exe
4648 explorer.exe
4648 explorer.exe

pid	process
4648	explorer.exe
4648	explorer.exe
4648	explorer.exe
4648	explorer.exe
4648	explorer.exe
4648	explorer.exe

C:\Users\Admin\AppData\Local\Temp\explorer.exe
"C:\Users\Admin\AppData\Local\Temp\explorer.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4648-132-0x0000000041700000-0x00000000417A6000-memory.dmp

Filesize
664KB

Download
memory/4648-134-0x0000000041700000-0x00000000417A6000-memory.dmp

Filesize
664KB

Download
memory/4648-135-0x0000000041700000-0x00000000417A6000-memory.dmp

Filesize
664KB

Download