640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913

General

Target

640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
Size

4.3MB
MD5

f7dbf6be3fc951697b713a286f4a6c48
SHA1

5b3eb15fefa4d8b546aa2987bcf36fcab901ae55
SHA256

640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913
SHA512

340fde9e9c16eb9fe374930f6f247b4662ff1b2c20b10a03d093fad497b2367512d1908dbab9d790f86b2d4b8904950eef8d8de214626cab467c0c0a66a56477
SSDEEP

49152:PSvd6wMpY+mCvZhCCuLHy44COCVTVvoNVQCOeAYjLpT465SDEk2YBC3iMcoFntAe:+6wMa+5CCOqnDJ1jt86Qn26F+l/vw

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1992-55-0x0000000000820000-0x00000000010FB000-memory.dmp	vmprotect
behavioral1/memory/1992-57-0x0000000000820000-0x00000000010FB000-memory.dmp	vmprotect
behavioral1/memory/1992-58-0x0000000000820000-0x00000000010FB000-memory.dmp	vmprotect

Drops file in System32 directory 5 IoCs

Processes:

640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\6F76wBxIl.systmp	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
File created	C:\Windows\SysWOW64\MakeAttManage.sys	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
File created	C:\Windows\SysWOW64\5A9ErWuJv.sys	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
File created	C:\Windows\SysWOW64\6F76wBxIl.sys	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
File opened for modification	C:\Windows\SysWOW64\6F76wBxIl.sys	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509bb0146c03d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000085b314262524a549bbf951d2bb11b68b00000000020000000000106600000001000020000000452994d8d422c8522745b3fd53fbe93cd217957fcf235d4591c83ddb98a67056000000000e8000000002000020000000c60dd46f931b84bc654655e36af7e67397bd6971499e033a91a764e5b34816ef90000000c21bbe1c75f0f3bc123db6d331088fde625cefa88e342cb806781873616259c3b1ca462cdbde2d011a207b588e683873db42dc4fa8a38ee6e2d97a2e6216ee0f2f044e29039addde22390abb2f2047387cf53bc28e8e799744a136ffb1e1fbec68a9dfd57f95ac22caea4679d7856d0e49a1ebc0723b79331b4e59cc69e8c772e9dfcf81da4408bc5fe864d4eb26539140000000b9cb026183f3f1e673778314c98b4a17ef9bf9c3a22fb6278efb6821a62945b1962f1ba1c5077b82acbb63391a39577e627a793f2e40995651d487a132d20c62	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376434011"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D658101-6F5F-11ED-BF27-66397CAA4A34} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000085b314262524a549bbf951d2bb11b68b00000000020000000000106600000001000020000000dabb805eb1ab33b86e49e45ab30222f5e02d7e01887a2c80e560c5dd66c33724000000000e8000000002000020000000bd562e0702e44c5777c36af2b00816fb16f94c2f4b51506ab0f5a5a4cc9f6b6f20000000b171a8e682b4f386730cced080fc4bf5dda427963d6a12014a1a9c977432e69e4000000007b2b8eba62282ed843e278d99e5a88abb4140e143acd1a4c945b278d5764ab7b50da995500be882004fce1505bf13317df99812435eac7f3cfda8e552a04151	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe

pid process

1992 640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
Suspicious behavior: LoadsDriver 3 IoCs

Processes:

pid process

468
468
468
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

840 iexplore.exe

pid	process
468
468
468

pid	process
840	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exeiexplore.exeIEXPLORE.EXE

pid	process
1992	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
1992	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
1992	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
1992	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
1992	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
1992	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
840	iexplore.exe
840	iexplore.exe
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exeiexplore.exe

description	pid	process	target process
PID 1992 wrote to memory of 840	1992	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe	iexplore.exe
PID 1992 wrote to memory of 840	1992	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe	iexplore.exe
PID 1992 wrote to memory of 840	1992	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe	iexplore.exe
PID 1992 wrote to memory of 840	1992	640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe	iexplore.exe
PID 840 wrote to memory of 1048	840	iexplore.exe	IEXPLORE.EXE
PID 840 wrote to memory of 1048	840	iexplore.exe	IEXPLORE.EXE
PID 840 wrote to memory of 1048	840	iexplore.exe	IEXPLORE.EXE
PID 840 wrote to memory of 1048	840	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe
"C:\Users\Admin\AppData\Local\Temp\640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.jdcqg.com/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat
Filesize
94KB

MD5
255960fac5e045e8a4127bd0b3d285ed

SHA1
aeaefb341069bc2d81f5a3876f7f73dc82822695

SHA256
e57833724aaff9f4f5cb46933651c7ae7378181866a9e6acdd83e6457db7446b

SHA512
72c24a00503e433dc3e0cfb2c704a33eed01ab286b3a87c697776e8883701ae6f4bfad556de5df2eb0053cc678ac161b8b09591a24e9694ae626d66e94e6e6b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3KBVOAQY.txt
Filesize
603B

MD5
c66b9a752432a7be5b75419a21a85660

SHA1
412869adcf5c88c22310ef8ac6a3c4520b7854dd

SHA256
ba767ecec110e45353170fe310f274620a479828d92942ce5e8515f04a37765a

SHA512
4e0057d0d3d5d70a1034c3adbda0b5eda5d5b52b83cc14df0015c17b490a9ff729ca00742e2a2642b1659311da9002084f760365a65c5e7ed5712b40b96b87c6

Download Submit
memory/1992-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000000820000-0x00000000010FB000-memory.dmp

Filesize
8.9MB

Download
memory/1992-57-0x0000000000820000-0x00000000010FB000-memory.dmp

Filesize
8.9MB

Download
memory/1992-58-0x0000000000820000-0x00000000010FB000-memory.dmp

Filesize
8.9MB

Download
memory/1992-60-0x0000000000810000-0x0000000000820000-memory.dmp

Filesize
64KB

Download
memory/1992-62-0x0000000000810000-0x0000000000820000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads