b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a

Analysis

max time kernel
181s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe
Size

964KB
MD5

26b420e6a13ff5154983c26a5b7da412
SHA1

79b2d064918b4f97afd02f71e4b5e197cc818827
SHA256

b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a
SHA512

38f0fc84f9cbce06109606ad631ab43167d6c07901e9e4f8260cd3ae1840eaae2e8758bbf4f4852e5c9baad766867084d43d0f5c632263ff2d7aaf901ee9d96d
SSDEEP

24576:TCHKRkjHIgjvTDfh7zR3L/CSbub7V2C2S6tfm:GHvjogDZ7l3Lqiu3/R2

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/1632-132-0x0000000000400000-0x00000000006DD000-memory.dmp	vmprotect
behavioral2/memory/1632-135-0x0000000000400000-0x00000000006DD000-memory.dmp	vmprotect
behavioral2/memory/1632-136-0x0000000000400000-0x00000000006DD000-memory.dmp	vmprotect
behavioral2/memory/1632-137-0x0000000000400000-0x00000000006DD000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1404 1632 WerFault.exe b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe

pid	pid_target	process	target process
1404	1632	WerFault.exe	b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe

Modifies registry class 2 IoCs

Processes:

b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe

pid	process
1632	b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe
1632	b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe
1632	b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe

C:\Users\Admin\AppData\Local\Temp\b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe
"C:\Users\Admin\AppData\Local\Temp\b60af774f94d5bc34f67a5e6c11685093d1fecdff994dd735d7a2ee32168d48a.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 33056
  2⤵
  - Program crash
  PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1632 -ip 1632
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-132-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/1632-135-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/1632-136-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/1632-137-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download