a0dcf63ff683243a2dd902ce32c6b9c607e953be27d7cdf056a1ef777015d1b8

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

急速辅助免费版1120/急速免费版1120（账号test密码123456）/账号test密码123456.exe
Size

11.4MB
MD5

4ca2b92346da55dabbc66eda9a767afc
SHA1

4dd740230a289742aae8d12602f797bd36ec12dc
SHA256

3216fb42e410628282217b865e93fa68aaedae52c9720d2ef7f5d967a57ee61f
SHA512

66a5144487cc342064e324bfab3951e1fbf586359d44ad68447aa4d23d1bb621ca1311fabb4c6170ee95c6de1b59e98745a33b0d71dfe7a8e2645ac9a8d54f34
SSDEEP

196608:CEgpi+gAopuROmoWrJe1cmk+At/DnNshvgcwAiRF5iwV:CEgpi+gAGoqWgcmkd/DNs5gDf4

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral31/memory/1444-58-0x0000000000F90000-0x0000000001002000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral31/memory/1444-55-0x0000000000400000-0x0000000000F87000-memory.dmp	vmprotect
behavioral31/memory/1444-57-0x0000000000400000-0x0000000000F87000-memory.dmp	vmprotect
behavioral31/memory/1444-60-0x0000000000400000-0x0000000000F87000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

账号test密码123456.exe

pid process

1444 账号test密码123456.exe
1444 账号test密码123456.exe
1444 账号test密码123456.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

账号test密码123456.exe

description pid process

Token: SeDebugPrivilege 1444 账号test密码123456.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

账号test密码123456.exe

pid process

1444 账号test密码123456.exe
1444 账号test密码123456.exe

pid	process
1444	账号test密码123456.exe
1444	账号test密码123456.exe
1444	账号test密码123456.exe

description	pid	process
Token: SeDebugPrivilege	1444	账号test密码123456.exe

pid	process
1444	账号test密码123456.exe
1444	账号test密码123456.exe

C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\账号test密码123456.exe
"C:\Users\Admin\AppData\Local\Temp\急速辅助免费版1120\急速免费版1120（账号test密码123456）\账号test密码123456.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1444

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1444-55-0x0000000000400000-0x0000000000F87000-memory.dmp

Filesize
11.5MB

Download
memory/1444-57-0x0000000000400000-0x0000000000F87000-memory.dmp

Filesize
11.5MB

Download
memory/1444-58-0x0000000000F90000-0x0000000001002000-memory.dmp

Filesize
456KB

Download
memory/1444-60-0x0000000000400000-0x0000000000F87000-memory.dmp

Filesize
11.5MB

Download
memory/1444-59-0x0000000000F90000-0x0000000001002000-memory.dmp

Filesize
456KB

Download