8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6

General

Target

8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe
Size

328KB
MD5

b564ff491a9d1d7cdeffb2f7348df2af
SHA1

fc1555103d25bba376d2ec7f2a8c092500131e15
SHA256

8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6
SHA512

49598cb5be45aac41b1f715aa20a2e3b735edeedd51c5fe13e9b26f9f2f1b35cd21db682dd2dc9681317e95b8f7e9e42b147a43563ed3ac9630a62a0ec3b6a75
SSDEEP

6144:tDRRSSgvVaoteY9reiN9GD7SE7NO56UNbY5bg4bntmTTd9ui0qC:Ni/asVPNK55O56URYl9T2uixC

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1400-54-0x0000000000400000-0x00000000004FD000-memory.dmp	vmprotect
behavioral1/memory/1400-56-0x0000000000400000-0x00000000004FD000-memory.dmp	vmprotect
behavioral1/memory/1400-59-0x0000000000400000-0x00000000004FD000-memory.dmp	vmprotect
behavioral1/memory/1400-60-0x0000000000400000-0x00000000004FD000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A73B3F1-7098-11ED-A645-626C2AE6DC56} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376568467"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b81ca55e2a24640a9162ad11c921edb00000000020000000000106600000001000020000000468544ae759c1d13e6b7666b17743dc9ddfc5212493c90b673b573e04c88f400000000000e800000000200002000000024b6c00593d12e67ff743966f9de65a4320e044497e4a4a6dc33fc083e7d5a61900000000bcc639d771b710ae7098716a361274535ab781b6f92eeffa13cf06dad8cf1832c443c166d56ff3d390bb02ebf072bf83d4d928e8648acb03dad6dee172a3648c9bbd281d7128faf17962d712eaa4e31783635c4482078b9e49ca7c7107ff7c9d0258d941d2d6117ba00dad542dfe22c28590a74639af3b8c22dd238c291e1387d2db99953fe7f959cad856c034d0fd040000000585a2328e375b8692248dcffa21d99b4b6a472c976b36e542b3f542077093cfa979d8c3b9a59a7e70a300d59febf65a1c28022ffd6f329fce630319fba089179	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b81ca55e2a24640a9162ad11c921edb00000000020000000000106600000001000020000000da51571d9701e1d5f49185c917064a8eaee6487f52b68ce66bb6420b16351daf000000000e8000000002000020000000d95b4ef6207e65a58a369a42ed84a6550e3aac8beb9d710d1769470b9ba93ce0200000001d1470f3ef374c0e96b7438bd54d538c0dbc35fa8fcfb98049e80ff46945fc09400000002e5c04a70abc6dceec9785879701b3669b3d470f9eb3c06fbed45c5b366b67839e368d265fe48f2252e9a69c2406213b1f059631971163dc359bbd15ec27ec5f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70273a31a504d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe

pid process

1400 8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1996 iexplore.exe

pid	process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exeiexplore.exeIEXPLORE.EXE

pid	process
1400	8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe
1400	8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe
1996	iexplore.exe
1996	iexplore.exe
676	IEXPLORE.EXE
676	IEXPLORE.EXE
676	IEXPLORE.EXE
676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exeiexplore.exe

description	pid	process	target process
PID 1400 wrote to memory of 1996	1400	8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe	iexplore.exe
PID 1400 wrote to memory of 1996	1400	8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe	iexplore.exe
PID 1400 wrote to memory of 1996	1400	8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe	iexplore.exe
PID 1400 wrote to memory of 1996	1400	8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe	iexplore.exe
PID 1996 wrote to memory of 676	1996	iexplore.exe	IEXPLORE.EXE
PID 1996 wrote to memory of 676	1996	iexplore.exe	IEXPLORE.EXE
PID 1996 wrote to memory of 676	1996	iexplore.exe	IEXPLORE.EXE
PID 1996 wrote to memory of 676	1996	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe
"C:\Users\Admin\AppData\Local\Temp\8a7e04f1a48e82e73027733bc04a28356716a6cf3acc5677f5b9a99de244afe6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://yy.duowan.com/go.html#6625
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
1c7d353d436727f12766a8f3ab5032b1

SHA1
15d045967ce27e7067aa800130068f0a31f5dd7c

SHA256
ad702725af38b78506e206940a00a8e09b974cc39cafc9c84c4a156c4b2f28c5

SHA512
df6e3b820bf7589e847abc470671ff56a175d87861f36299bab6af26d072d60394b1c421f1df52a1e51c7b6b7e1311c3c416b091c0620539c832c5b2f7d69c85

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\834Y9BUP.txt
Filesize
603B

MD5
d11bc88643f054ec3436d610b9acfdfe

SHA1
89e4b5f57aca448fdc3a4dbb2c589bd7b383a4bd

SHA256
387eaf07a800f60b098dcf661d819a1d639350bb32156319a9001306347f6308

SHA512
47a93854c54ba8c5afce0e24e85c57a1f3aefee5a16c3178224777cc3e23aee528577ed6c34df15e6991e5f2a9b29c6401b9b51b0425dc353c9c6892fdc2d10a

Download Submit
memory/1400-54-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1400-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1400-56-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1400-59-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1400-60-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads