82a6400e6297ce6dc3f791c98291e7273ec94487172b06d553cbd89287abcc13

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2023 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe
Size

3.5MB
MD5

8a470899a6ebb2299b54da55ad3897d2
SHA1

1ebafddb262fe912641e260fcf407907ca67fb74
SHA256

7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313
SHA512

dde4489c467d232c5b8e7930ff0991c33aa1477666984bf69559556229b5a76951015fe38993d7289acb5aa5e9661126ed1ac9878cf44a4fbf9b06e57e1275b4
SSDEEP

49152:SMQyNFL4gSeOzD5rbhdU7bSVziW+Gz/6Sq5ms7Otvx2mAmMm0pFZMpTBkRdFFU2:NL4B35rbhCkiStvx2GcFZM1BOU

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1840-134-0x0000000000A00000-0x0000000000D7E000-memory.dmp	vmprotect

Kills process with taskkill 1 IoCs

evasion

pid	Process
348	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1840	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe
1840	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1840	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe
Token: SeDebugPrivilege	348	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 380	1840	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe	93
PID 1840 wrote to memory of 380	1840	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe	93
PID 1840 wrote to memory of 380	1840	7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe	93
PID 380 wrote to memory of 348	380	cmd.exe	95
PID 380 wrote to memory of 348	380	cmd.exe	95
PID 380 wrote to memory of 348	380	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe
"C:\Users\Admin\AppData\Local\Temp\7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c taskkill /F /IM 7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM 7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-133-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/1840-134-0x0000000000A00000-0x0000000000D7E000-memory.dmp

Filesize
3.5MB

Download
memory/1840-135-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/1840-136-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/1840-137-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/1840-138-0x0000000005790000-0x00000000057A0000-memory.dmp

Filesize
64KB

Download
memory/1840-139-0x0000000005C10000-0x0000000005CAC000-memory.dmp

Filesize
624KB

Download
memory/1840-140-0x0000000006260000-0x0000000006804000-memory.dmp

Filesize
5.6MB

Download
memory/1840-141-0x0000000005CB0000-0x0000000005D42000-memory.dmp

Filesize
584KB

Download
memory/1840-142-0x0000000005B80000-0x0000000005B8A000-memory.dmp

Filesize
40KB

Download
memory/1840-143-0x0000000005EA0000-0x0000000005EF6000-memory.dmp

Filesize
344KB

Download
memory/1840-144-0x0000000005790000-0x00000000057A0000-memory.dmp

Filesize
64KB

Download
memory/1840-145-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/1840-146-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/1840-147-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download
memory/1840-148-0x0000000005790000-0x00000000057A0000-memory.dmp

Filesize
64KB

Download
memory/1840-149-0x0000000005790000-0x00000000057A0000-memory.dmp

Filesize
64KB

Download
memory/1840-150-0x0000000005790000-0x00000000057A0000-memory.dmp

Filesize
64KB

Download
memory/1840-154-0x0000000074C20000-0x00000000753D0000-memory.dmp

Filesize
7.7MB

Download