ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410

Analysis

max time kernel
142s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe
Size

1.4MB
MD5

a30b7105011aeacbb3c25b593e5f2561
SHA1

d8f8a8adbaaf3d9fabc9493610fe7cb642a32ab9
SHA256

ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410
SHA512

8ab29413e830a2404ab4df2d0d3f86b7ff602ad6dfb4e49fb3862e303076c14d47ce3db570eafb8c0872bacd3f4334a7323ee3a6db7c0d37b76799c0710d89fb
SSDEEP

24576:oGVOffwKGzJBMmWc0Kwb0s3r0q3QNuG3zoa0Jq/07mOeVZqLqUoLvNop2zbbiEkP:BVS4KGl73fs7MuG3zpEqM7iKeUelgabt

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1308-55-0x0000000000400000-0x0000000000769000-memory.dmp	vmprotect
behavioral1/memory/1308-57-0x0000000000400000-0x0000000000769000-memory.dmp	vmprotect
behavioral1/memory/1308-58-0x0000000000400000-0x0000000000769000-memory.dmp	vmprotect
behavioral1/memory/1308-60-0x0000000000400000-0x0000000000769000-memory.dmp	vmprotect

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?k23848535"	ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe

pid process

1308 ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe

pid	process
1308	ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe
1308	ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe
1308	ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe
1308	ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe

C:\Users\Admin\AppData\Local\Temp\ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe
"C:\Users\Admin\AppData\Local\Temp\ee4b352de5e7990ddaed1142f9b9e8b7132c36546f5c14c6583bd5412e1c1410.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1308

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1308-55-0x0000000000400000-0x0000000000769000-memory.dmp

Filesize
3.4MB

Download
memory/1308-57-0x0000000000400000-0x0000000000769000-memory.dmp

Filesize
3.4MB

Download
memory/1308-58-0x0000000000400000-0x0000000000769000-memory.dmp

Filesize
3.4MB

Download
memory/1308-60-0x0000000000400000-0x0000000000769000-memory.dmp

Filesize
3.4MB

Download