a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803

General

Target

a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
Size

10.2MB
MD5

92b29237e0ca168038266764b4654bdd
SHA1

fe741a54221ee54aab09856304f862296d6a7a5f
SHA256

a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803
SHA512

ac52eba4cdfff4969833e4f86348964e1c04e67ed2d31953056d26c02025ed12ca2870146fff2b5c43fefe4fa4c5ad0f968c8297bb56bb99c1dad95377796e04
SSDEEP

196608:TohssNIte1cmk+n85NGp1I0xTL5oLVD/:TA3cmkxNGpK0QF

Score

8^/10

upx vmprotect

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

description ioc process

File created C:\Windows\system32\Drivers\etc\hosts a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\etc\hosts	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/288-57-0x00000000026B0000-0x0000000002722000-memory.dmp	upx
behavioral1/memory/288-58-0x00000000026B0000-0x0000000002722000-memory.dmp	upx

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/288-55-0x0000000000400000-0x0000000000E65000-memory.dmp	vmprotect
behavioral1/memory/288-56-0x0000000000400000-0x0000000000E65000-memory.dmp	vmprotect
behavioral1/memory/288-59-0x00000000744A0000-0x0000000074659000-memory.dmp	vmprotect
behavioral1/memory/288-61-0x00000000744A0000-0x0000000074659000-memory.dmp	vmprotect
behavioral1/memory/288-62-0x0000000000400000-0x0000000000E65000-memory.dmp	vmprotect
behavioral1/memory/288-63-0x00000000744A0000-0x0000000074659000-memory.dmp	vmprotect

Drops file in System32 directory 5 IoCs

Processes:

a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\71F2LzmXs.sys	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
File opened for modification	C:\Windows\SysWOW64\71F2LzmXs.systmp	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
File created	C:\Windows\SysWOW64\MakeAttManage.sys	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
File created	C:\Windows\SysWOW64\5B2FmryAx.sys	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
File created	C:\Windows\SysWOW64\71F2LzmXs.sys	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

Drops file in Windows directory 2 IoCs

Processes:

a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

description	ioc	process
File created	C:\Windows\hh.ini	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
File created	C:\Windows\game.dll	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a605278edf5504aa2a4dcb45eb4e81800000000020000000000106600000001000020000000f7d84786ad90c803b975e0df35d077cb7e36e78f00bf9c823e4d43104a4f4d8c000000000e800000000200002000000009ee0b30797d99da091cb8ef8764e78a8d8fae8cfe948a6c34146664a6c83abc20000000c48c131e483e8ce57635a267f37c7656b232fae08f150fd4b2987a7d4b2655d640000000ba0fc7a5a8c67ca724c3eba1f43b7ded4d99da85e8b877698c18bbaeb3568981866b5bdabbed0a1e9660973a86670f3a1ca7b0aa18c746b3ce7fd7437ef65add	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f97f42d701d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3962D081-6DCA-11ED-9584-C22E595EE768} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376260073"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a605278edf5504aa2a4dcb45eb4e8180000000002000000000010660000000100002000000084a91476595958d44c6176992311be926734ee7450d312333d20db5653cfe926000000000e800000000200002000000052f95e4125dcc2eb47dda83f0701b8418b7fb61205c80fe647a813c6b6c94c5290000000dd33d1af203dd5246516d12a8912f563e6f9592cb9fe455a8c416408ea5c797c37184cc743645355dc6e246d92cc51c8ec46686e9f884e0af033dae9b0d97dc2f0686e846765c5c2367dd750fadb031f4ff1fa76abb9c6041f689e8ae704f302d9019f3776ce5f4f58de0033e88b7101d17214cd1507d42654164b3684b0b8240be53f87ca6b67a8d5709b1215f06c7f40000000cd5ef8944349e7fac8a88110d5273970308791f22c7dbcf9c0bdf8db65c663498638e5f0949dd9b8d95a77c22cdf1c0c6bc61d96820b9abb1a5cc98b1e5111fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

pid	process
288	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
288	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
288	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

Suspicious behavior: LoadsDriver 3 IoCs

Processes:

pid process

464
464
464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

description pid process

Token: SeDebugPrivilege 288 a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1240 iexplore.exe

pid	process
464
464
464

description	pid	process
Token: SeDebugPrivilege	288	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe

pid	process
1240	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exeiexplore.exeIEXPLORE.EXE

pid	process
288	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
288	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
1240	iexplore.exe
1240	iexplore.exe
760	IEXPLORE.EXE
760	IEXPLORE.EXE
760	IEXPLORE.EXE
760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exeiexplore.exe

description	pid	process	target process
PID 288 wrote to memory of 1240	288	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe	iexplore.exe
PID 288 wrote to memory of 1240	288	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe	iexplore.exe
PID 288 wrote to memory of 1240	288	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe	iexplore.exe
PID 288 wrote to memory of 1240	288	a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe	iexplore.exe
PID 1240 wrote to memory of 760	1240	iexplore.exe	IEXPLORE.EXE
PID 1240 wrote to memory of 760	1240	iexplore.exe	IEXPLORE.EXE
PID 1240 wrote to memory of 760	1240	iexplore.exe	IEXPLORE.EXE
PID 1240 wrote to memory of 760	1240	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe
"C:\Users\Admin\AppData\Local\Temp\a370d1c0dc04d8fab6ccaac46a873a0e730ddcd65e095b1459254cdce540f803.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.jisu520.com/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1240 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5OVU4EBF.txt
Filesize
603B

MD5
716673b6af4cfb53cf37d05acd798f15

SHA1
a80e8f1b167b5a1a0b480798f426e1d3e9346975

SHA256
fe88920d02df8c72bb6ea29f940d389a0d3a42c71af9a9c57aea998de91334b6

SHA512
e6e52ff2a496d42f40a9eae314fe20fd2b8e82ef8b2002f01dff8fd80159da8bb455e6206dcc125c1eb1a992e515a56535edf6fa4b3f40c286b9f91449ca461e

Download Submit
memory/288-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/288-55-0x0000000000400000-0x0000000000E65000-memory.dmp

Filesize
10.4MB

Download
memory/288-56-0x0000000000400000-0x0000000000E65000-memory.dmp

Filesize
10.4MB

Download
memory/288-57-0x00000000026B0000-0x0000000002722000-memory.dmp

Filesize
456KB

Download
memory/288-58-0x00000000026B0000-0x0000000002722000-memory.dmp

Filesize
456KB

Download
memory/288-59-0x00000000744A0000-0x0000000074659000-memory.dmp

Filesize
1.7MB

Download
memory/288-61-0x00000000744A0000-0x0000000074659000-memory.dmp

Filesize
1.7MB

Download
memory/288-62-0x0000000000400000-0x0000000000E65000-memory.dmp

Filesize
10.4MB

Download
memory/288-63-0x00000000744A0000-0x0000000074659000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads