2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220

Analysis

max time kernel
151s
max time network
196s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe
Size

112KB
MD5

e89dd7ebedfaabffe9c5da548af40cf7
SHA1

5194e471dac60d9c90a5395208fb674110c8ae7e
SHA256

2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220
SHA512

8087a2569e181ef3cacdf5531a0d9145d7ec2f024e49a4f6b3bb6134ca90a13746f89bcb01181fccb7e7d978dff6b1090ee1a306efada7265610ac36252ca68e
SSDEEP

3072:vFQgWfhC4PdN8TAGkRzUNz7rtk3NfPeQi2K7VxRqkZ4raq:9QlE43eAGktm63hPwp7VxRq1rB

Score

8^/10

persistence vmprotect

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\IPv6NetBrowsSvc\Parameters\ServiceDll = "C:\\Windows\\IPv6NetBrowsSvc.dll"	2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1964-55-0x00000000009B0000-0x00000000009E9000-memory.dmp	vmprotect
\??\c:\windows\ipv6netbrowssvc.dll	vmprotect
behavioral1/memory/1956-60-0x00000000748F0000-0x0000000074929000-memory.dmp	vmprotect
behavioral1/memory/1956-62-0x00000000748F0000-0x0000000074929000-memory.dmp	vmprotect

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

336 cmd.exe

pid	process
336	cmd.exe

Drops file in Windows directory 2 IoCs

Processes:

2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe

description	ioc	process
File created	C:\Windows\IPv6NetBrowsSvc.dll	2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe
File opened for modification	C:\Windows\IPv6NetBrowsSvc.dll	2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe

description	pid	process	target process
PID 1964 wrote to memory of 336	1964	2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe	cmd.exe
PID 1964 wrote to memory of 336	1964	2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe	cmd.exe
PID 1964 wrote to memory of 336	1964	2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe	cmd.exe
PID 1964 wrote to memory of 336	1964	2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe
"C:\Users\Admin\AppData\Local\Temp\2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7134424.bat" "
2⤵
- Deletes itself
PID:336

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k ipv6srvs
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7134424.bat
Filesize
239B

MD5
ac7b10114de43e1b08690e991e36513a

SHA1
434cf017c932fa144c6b7d43e2782d4b10de2cd4

SHA256
3e9f56b98060d448fe2ca7026afae7c545216356677063215bf58f635837ed1f

SHA512
a1a7ccd03be2bf846b64b13e440c024c1c8241328bf93c533914b1e4e6d31c12aee023c7646e61451992f2ffa8bcea889b982448ee6d2e6a16f9bb0876cc2c18

Download Submit
\??\c:\windows\ipv6netbrowssvc.dll
Filesize
112KB

MD5
5e886d049a9f45e8b9de6c9b3f36c3c2

SHA1
11e3e58f76fbe87d4f4e806d5b1cce7d29d32ee5

SHA256
284217c717da286f7f613c53e1f134808b7bba010ad945212b7ba6db3f01ca39

SHA512
d97a26c235f6560b7ab8eca5e07082f04de55683454803c15bc405f8951ddeda31a85ccd4181adc0bdf19452f693e89174c68bee1a45d584bd4a710fa6c7890d

Download Submit
memory/336-59-0x0000000000000000-mapping.dmp

Download
memory/1956-58-0x00000000748F1000-0x00000000748F4000-memory.dmp

Filesize
12KB

Download
memory/1956-60-0x00000000748F0000-0x0000000074929000-memory.dmp

Filesize
228KB

Download
memory/1956-62-0x00000000748F0000-0x0000000074929000-memory.dmp

Filesize
228KB

Download
memory/1964-54-0x00000000009B1000-0x00000000009B4000-memory.dmp

Filesize
12KB

Download
memory/1964-55-0x00000000009B0000-0x00000000009E9000-memory.dmp

Filesize
228KB

Download
memory/1964-57-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download