5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b

Analysis

max time kernel
96s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe
Size

132KB
MD5

3584a555c1997c24f2b3ce50a548989a
SHA1

9da453a5d106376cf80486c8ef5b055932085f0e
SHA256

5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b
SHA512

c079ecf179c4deb949a1e6d3164e8ad447a0b1246a46e0d2414578bc346e6f8e1ca3ae47968c8231c6f9b604d6c51b7921db7181ed92f3b02c55ad0c8fc83cbe
SSDEEP

3072:z7sMt/4qJ0HrAxtJtd1WnSWDSucrIpWgQrOA5yeowijx5Gg:zzaLAISWMEpdQi3e1+B

Score

8^/10

persistence vmprotect

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9E6B2AC-2E73-DBCA-F1B6-10B3DCA0849F}	5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9E6B2AC-2E73-DBCA-F1B6-10B3DCA0849F}\stubpath = "C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\apple.exe"	5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4944-132-0x0000000000400000-0x0000000000423000-memory.dmp	vmprotect
behavioral2/memory/4944-134-0x0000000000400000-0x0000000000423000-memory.dmp	vmprotect
behavioral2/memory/4944-135-0x0000000000400000-0x0000000000423000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4944	5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\apple.exe	5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe
File opened for modification	C:\Program Files\Common Files\Apple\Mobile Device Support\apple.exe	5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3124	4944	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4900	4944	5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe	79
PID 4944 wrote to memory of 4900	4944	5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe	79
PID 4944 wrote to memory of 4900	4944	5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe	79

C:\Users\Admin\AppData\Local\Temp\5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe
"C:\Users\Admin\AppData\Local\Temp\5ce5323ce50ae9ae0abc7e0f6af4e26e408aee818e1296ffd09b206143c1ba1b.exe"
1⤵
- Modifies Installed Components in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\{B9E6B2AC-2E73-DBCA-F1B6-10B3DCA0849F}" /f
  2⤵
  PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 1928
  2⤵
  - Program crash
  PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4944 -ip 4944
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4944-132-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4944-134-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4944-135-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download