607d460d4843e160a834db1342497e23f20d27627991fc6008caeeeefb0f25f6

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

607d460d4843e160a834db1342497e23f20d27627991fc6008caeeeefb0f25f6.exe
Size

167KB
MD5

bae1e5824f382c26ce12f42143ac2c18
SHA1

d299ab4599c2018eb63bec4e47e4ad6ec1fe9977
SHA256

607d460d4843e160a834db1342497e23f20d27627991fc6008caeeeefb0f25f6
SHA512

a19cbde8f259c97b3385235bcb03817a60e3026fc60aefee84237ad450e0a577471dac12e5214d96a2fc1f9bc5c536ae14393352ef16bf6273ebf5a31b4833d8
SSDEEP

3072:CgUxT0GrZD0jbbpu4S5xxoysqDv2DI+NPB2+lf4HbEE6KWQNmSF:CJxT0iZojbbpuh5xxokDabNI+pnI

Score

10^/10

evasion trojan vmprotect

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	607d460d4843e160a834db1342497e23f20d27627991fc6008caeeeefb0f25f6.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4180-132-0x0000000000400000-0x0000000000426000-memory.dmp	vmprotect
behavioral2/memory/4180-133-0x0000000000400000-0x0000000000426000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\test.dat	607d460d4843e160a834db1342497e23f20d27627991fc6008caeeeefb0f25f6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4180	607d460d4843e160a834db1342497e23f20d27627991fc6008caeeeefb0f25f6.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	607d460d4843e160a834db1342497e23f20d27627991fc6008caeeeefb0f25f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	607d460d4843e160a834db1342497e23f20d27627991fc6008caeeeefb0f25f6.exe

C:\Users\Admin\AppData\Local\Temp\607d460d4843e160a834db1342497e23f20d27627991fc6008caeeeefb0f25f6.exe
"C:\Users\Admin\AppData\Local\Temp\607d460d4843e160a834db1342497e23f20d27627991fc6008caeeeefb0f25f6.exe"
1⤵
- UAC bypass
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System policy modification
PID:4180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4180-132-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4180-133-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads