fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564

Analysis

max time kernel
118s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
Size

946KB
MD5

68e2b5e2d9f8c97fef076a22b680bb1d
SHA1

8b8a7b15c73c8cf416f4fc40b1301599d5b78ded
SHA256

fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564
SHA512

b22423284ff1f8cc2dd10ed1cd9fb23471d19ce2b2afffff7396bdc5ba2e7a45a30cafa4573311aaae03e6e22aa4b3168ec14db2a9eecab8f420e689e316f612
SSDEEP

24576:Lbj1xNTf9fK3X2LMCBEcOaFxLpkaF9woZouHC:nV9flckRp3XZoYC

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vmnat32\\vmnat32.exe"	reg.exe

Executes dropped EXE 2 IoCs

Processes:

vmnat32 .exevmnat32 .exe

pid process

276 vmnat32 .exe
1644 vmnat32 .exe

pid	process
276	vmnat32 .exe
1644	vmnat32 .exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1644-86-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral1/memory/1644-89-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral1/memory/1644-92-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral1/memory/1644-96-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral1/memory/1644-98-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral1/memory/1644-99-0x0000000001610000-0x0000000001720000-memory.dmp	upx
behavioral1/memory/1644-100-0x0000000001610000-0x0000000001720000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vmnat32.exe	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vmnat32.exe	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exevmnat32 .exe

pid process

1288 fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
276 vmnat32 .exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exevmnat32 .exe

description	pid	process	target process
PID 1288 set thread context of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 276 set thread context of 1644	276	vmnat32 .exe	vmnat32 .exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exevmnat32 .exe

pid	process
1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
1644	vmnat32 .exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe

description	pid	process
Token: SeDebugPrivilege	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
Token: 33	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
Token: SeIncBasePriorityPrivilege	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

vmnat32 .exevmnat32 .exe

pid process

276 vmnat32 .exe
1644 vmnat32 .exe

pid	process
276	vmnat32 .exe
1644	vmnat32 .exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.execmd.exewscript.execmd.exevmnat32 .exe

description	pid	process	target process
PID 1288 wrote to memory of 1200	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	cmd.exe
PID 1288 wrote to memory of 1200	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	cmd.exe
PID 1288 wrote to memory of 1200	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	cmd.exe
PID 1288 wrote to memory of 1200	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	cmd.exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1200 wrote to memory of 1736	1200	cmd.exe	wscript.exe
PID 1200 wrote to memory of 1736	1200	cmd.exe	wscript.exe
PID 1200 wrote to memory of 1736	1200	cmd.exe	wscript.exe
PID 1200 wrote to memory of 1736	1200	cmd.exe	wscript.exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1288 wrote to memory of 276	1288	fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe	vmnat32 .exe
PID 1736 wrote to memory of 940	1736	wscript.exe	cmd.exe
PID 1736 wrote to memory of 940	1736	wscript.exe	cmd.exe
PID 1736 wrote to memory of 940	1736	wscript.exe	cmd.exe
PID 1736 wrote to memory of 940	1736	wscript.exe	cmd.exe
PID 940 wrote to memory of 1116	940	cmd.exe	reg.exe
PID 940 wrote to memory of 1116	940	cmd.exe	reg.exe
PID 940 wrote to memory of 1116	940	cmd.exe	reg.exe
PID 940 wrote to memory of 1116	940	cmd.exe	reg.exe
PID 276 wrote to memory of 1644	276	vmnat32 .exe	vmnat32 .exe
PID 276 wrote to memory of 1644	276	vmnat32 .exe	vmnat32 .exe
PID 276 wrote to memory of 1644	276	vmnat32 .exe	vmnat32 .exe
PID 276 wrote to memory of 1644	276	vmnat32 .exe	vmnat32 .exe
PID 276 wrote to memory of 1644	276	vmnat32 .exe	vmnat32 .exe
PID 276 wrote to memory of 1644	276	vmnat32 .exe	vmnat32 .exe
PID 276 wrote to memory of 1644	276	vmnat32 .exe	vmnat32 .exe
PID 276 wrote to memory of 1644	276	vmnat32 .exe	vmnat32 .exe

C:\Users\Admin\AppData\Local\Temp\fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe
"C:\Users\Admin\AppData\Local\Temp\fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\vmnat32\mata.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\vmnat32\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\vmnat32\mata2.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\vmnat32\mata2.bat" "
4⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\vmnat32\vmnat32.exe" /f
5⤵
- Modifies WinLogon for persistence
PID:1116

C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe
"C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:276

C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe
"C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vmnat32 .exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vmnat32\invs.vbs
Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vmnat32\mata.bat
Filesize
64B

MD5
a8f6212dcdee196f8c2c4817a33d29b1

SHA1
12a7af0aec84dfe907d1e92bf357beb4fb8045ee

SHA256
bb9f120c46293f14475af4eda500d904591d147bf7a1db2498635b08f89c8254

SHA512
15cb773b072580e92965474ddc7cdd531509f79fa7701ab7496e3bf9a77ce512512b1fda2a71b03215b24fac346055db68782343d44e030b539982bc437444dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vmnat32\mata2.bat
Filesize
443B

MD5
3c6f772b02ce1fd8a9ca9c14ab57c8f1

SHA1
f6782ca24a69c3d0ee27fb0addf9460d09a10139

SHA256
46a2fe711921bc4daa32095fe1f4c9dd717fad67fe2513c52464f5158f2bfa61

SHA512
dea706fe564d1391e9577ecb4a1296a1ec616dd7e78091f9bbe70ba4d03fe6d78b01885f87c2d3a55c3627df43c6f0f9db16c41b181a2c5986c8965a45fbb0f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vmnat32\vmnat32.exe
Filesize
946KB

MD5
68e2b5e2d9f8c97fef076a22b680bb1d

SHA1
8b8a7b15c73c8cf416f4fc40b1301599d5b78ded

SHA256
fe93726258af804e0ee3d0f285e712552da8a65579234d44f0a1a0820b418564

SHA512
b22423284ff1f8cc2dd10ed1cd9fb23471d19ce2b2afffff7396bdc5ba2e7a45a30cafa4573311aaae03e6e22aa4b3168ec14db2a9eecab8f420e689e316f612

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ugZbB4g25fC\ugZbB4g25fC.dat
Filesize
2B

MD5
93e00066d099c0485cfffa1359246d26

SHA1
bc69a773f37b2f2071e25f755a66d47b871e5d98

SHA256
3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

SHA512
d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ugZbB4g25fC\ugZbB4g25fC.nfo
Filesize
3KB

MD5
bdff6a728cf2f19109c578ddd6e8687c

SHA1
ae0457c533bba1799df4aae97755798d7b8b5946

SHA256
da85bbbc3fd708bd260239ea1c09fdfcd00847e7d5a19629c613ebe196ba4ca3

SHA512
3d32ce12b58b371ea163d1c4911e9ef058e95c610c2a6a08104c210830157971b1c8f33690dd1844e8986f72da0efa8fb893d8b60fbbe762a12d80335efa99db

Download Submit
\Users\Admin\AppData\Local\Temp\vmnat32 .exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
\Users\Admin\AppData\Local\Temp\vmnat32 .exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
memory/276-65-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/276-66-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/276-69-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/276-62-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/276-72-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/276-70-0x0000000000408600-mapping.dmp

Download
memory/276-74-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/276-63-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/276-64-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/276-60-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/276-58-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/276-80-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/940-78-0x0000000000000000-mapping.dmp

Download
memory/1116-79-0x0000000000000000-mapping.dmp

Download
memory/1200-55-0x0000000000000000-mapping.dmp

Download
memory/1288-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1288-85-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1288-59-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1644-100-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1644-92-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1644-96-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1644-94-0x000000000171D0D0-mapping.dmp

Download
memory/1644-98-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1644-99-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1644-89-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1644-86-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1644-84-0x0000000001610000-0x0000000001720000-memory.dmp

Filesize
1.1MB

Download
memory/1644-103-0x00000000016C5000-0x000000000171E000-memory.dmp

Filesize
356KB

Download
memory/1644-104-0x0000000001611000-0x00000000016C5000-memory.dmp

Filesize
720KB

Download
memory/1644-105-0x00000000016C5000-0x000000000171E000-memory.dmp

Filesize
356KB

Download
memory/1736-67-0x0000000000000000-mapping.dmp

Download