b0d8f653ac2c067c0f9a2a188d8690c361159b599a10863664b0a8595134688a

Analysis

max time kernel
61s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ρս1.5.vmp.exe
Size

1.5MB
MD5

42cafa1ad78f88a6436628a351d94462
SHA1

575d2b6f04c8eb0887d21f7d5964d4aa24bda869
SHA256

abeeeeb585427ef539dbf436ddce39a3310d5f0baec87078a67c401cde44e9de
SHA512

f129d6981eceba8e04c541ac739fe182e3de3db65f56a98bab6f90e2378077e806872ae67bcf8a85d10541bd0f32bda0b22c6885a1502b0ccdc879b05f69fb9d
SSDEEP

49152:AX8XK7vXz/IQUTfOz/HR3zx5HzKjc8Qt1gJOSeM5jGeK:c6+vj7M+ZV598zJOL2

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/1728-132-0x0000000000400000-0x000000000082B000-memory.dmp	vmprotect
behavioral2/memory/1728-133-0x0000000000400000-0x000000000082B000-memory.dmp	vmprotect
behavioral2/memory/1728-135-0x0000000000400000-0x000000000082B000-memory.dmp	vmprotect

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

Ρս1.5.vmp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	Ρս1.5.vmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/?28879"	Ρս1.5.vmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/?28879"	Ρս1.5.vmp.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

Ρս1.5.vmp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?28879"	Ρս1.5.vmp.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Ρս1.5.vmp.exe

pid	process
1728	Ρս1.5.vmp.exe
1728	Ρս1.5.vmp.exe
1728	Ρս1.5.vmp.exe
1728	Ρս1.5.vmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Ρս1.5.vmp.exe

description pid process

Token: SeDebugPrivilege 1728 Ρս1.5.vmp.exe

description	pid	process
Token: SeDebugPrivilege	1728	Ρս1.5.vmp.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Ρս1.5.vmp.exe

pid	process
1728	Ρս1.5.vmp.exe
1728	Ρս1.5.vmp.exe
1728	Ρս1.5.vmp.exe

C:\Users\Admin\AppData\Local\Temp\Ρս1.5.vmp.exe
"C:\Users\Admin\AppData\Local\Temp\Ρս1.5.vmp.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-132-0x0000000000400000-0x000000000082B000-memory.dmp

Filesize
4.2MB

Download
memory/1728-133-0x0000000000400000-0x000000000082B000-memory.dmp

Filesize
4.2MB

Download
memory/1728-135-0x0000000000400000-0x000000000082B000-memory.dmp

Filesize
4.2MB

Download