4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710

Analysis

max time kernel
36s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe
Size

4.8MB
MD5

abfaaa13c6ac217cca27b3b57da24b1b
SHA1

426fee01e711ba2e9fd5d24eecc91c6190363c09
SHA256

4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710
SHA512

5365e1f45ed6b6a2f94b198a6e96a6dd9f5e900bf5a48739710cccad86ce0d2d42193b4a7eb8d7c4b4a7d2f3e34996446d175f7fd5eb08a6b46ff40d2e1db066
SSDEEP

98304:Flp/68lxG8XCR4v4VB4a9Xu2hgAOi3Wqojykg5mtFuyQO6+Yx1S0f+TdICQ:HN68lI0Zv48a5u2hZOiujyv5OFuy1RYx

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1080-55-0x0000000000400000-0x00000000010D2000-memory.dmp	vmprotect
behavioral1/memory/1080-57-0x0000000000400000-0x00000000010D2000-memory.dmp	vmprotect
behavioral1/memory/1080-58-0x0000000000400000-0x00000000010D2000-memory.dmp	vmprotect

Drops file in Windows directory 1 IoCs

Processes:

4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe

description ioc process

File created C:\Windows\29vzyb9s.sys 4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe

description	ioc	process
File created	C:\Windows\29vzyb9s.sys	4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe

pid	process
1080	4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe
1080	4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460

pid	process
460

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe

pid	process
1080	4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe
1080	4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe
1080	4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe
1080	4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe

C:\Users\Admin\AppData\Local\Temp\4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe
"C:\Users\Admin\AppData\Local\Temp\4ffa4159a9d68c344f8969eab8b38bc7eac3ad8014221174157fb5e36d919710.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1080-55-0x0000000000400000-0x00000000010D2000-memory.dmp

Filesize
12.8MB

Download
memory/1080-57-0x0000000000400000-0x00000000010D2000-memory.dmp

Filesize
12.8MB

Download
memory/1080-58-0x0000000000400000-0x00000000010D2000-memory.dmp

Filesize
12.8MB

Download