670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4

General

Target

670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe
Size

2.6MB
MD5

e3475871ec56c555622cf4a9dfe2fb43
SHA1

80d13e1875b65c54a353232280fea6872533a914
SHA256

670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4
SHA512

54f0b5e3c5bb173be1e064857d8d69e0ec4dab1e2767557b7064891ee38d6163b02d3cc7306e9ad187340562fbd61312cd49b5ff6bd8ab63c0aac4fc25319c88
SSDEEP

49152:MpaoWYCftDkA+fm922Njn0YHXvPezS1UjipD49Eqej6o9txJV:8aoWYCFpQGhrXvPe+1UwMEVXtxJ

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/3068-132-0x00000000000D0000-0x000000000060D000-memory.dmp	vmprotect
behavioral2/memory/3068-133-0x00000000000D0000-0x000000000060D000-memory.dmp	vmprotect
behavioral2/memory/3068-136-0x00000000000D0000-0x000000000060D000-memory.dmp	vmprotect
behavioral2/memory/3068-139-0x00000000000D0000-0x000000000060D000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe

pid	process
3068	670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe
3068	670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe

pid	process
3068	670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe
3068	670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe
3068	670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe
3068	670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe
3068	670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exemsedge.exe

description	pid	process	target process
PID 3068 wrote to memory of 2164	3068	670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe	msedge.exe
PID 3068 wrote to memory of 2164	3068	670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe	msedge.exe
PID 2164 wrote to memory of 4380	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4380	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 5072	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 1396	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 1396	2164	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe
"C:\Users\Admin\AppData\Local\Temp\670d3697dd2d4dde405aa38f36f7c6b926d1c781ae04223197be9fe5d1d5b3e4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.jdcqg.com/
2⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0xfc,0x100,0x40,0x104,0x7ff80c1446f8,0x7ff80c144708,0x7ff80c144718
3⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5201017739189897031,10518029813547413861,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
3⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5201017739189897031,10518029813547413861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
3⤵
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-142-0x0000000000000000-mapping.dmp

Download
memory/2164-137-0x0000000000000000-mapping.dmp

Download
memory/3068-132-0x00000000000D0000-0x000000000060D000-memory.dmp

Filesize
5.2MB

Download
memory/3068-133-0x00000000000D0000-0x000000000060D000-memory.dmp

Filesize
5.2MB

Download
memory/3068-136-0x00000000000D0000-0x000000000060D000-memory.dmp

Filesize
5.2MB

Download
memory/3068-139-0x00000000000D0000-0x000000000060D000-memory.dmp

Filesize
5.2MB

Download
memory/4380-138-0x0000000000000000-mapping.dmp

Download
memory/5072-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads