78a28b25b330513649439305a5d9293cb07fb796ad6521ef31f39a5453a549d8

Resubmissions

07-09-2023 14:45

230907-r45fysaf5s 10

07-09-2023 14:12

230907-rjbyxaad5s 10

Analysis

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe
Size

620KB
MD5

5376a226b33db36b51bf85b910071031
SHA1

ee89a2daf45bda00154a181b0713d351a19b6e00
SHA256

2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc
SHA512

38fae7a2ef4ba9d8633dd6898f525a6d4ef91813700eb5b95a4e13dfe6caea8d291eedfd092916a50b401cb9bef24adb2a2878b327a4f00c0590d09948483083
SSDEEP

12288:wUA9qXSileJnwNoFp1ayIfKIemXyYL1LyV/G/0HCO3ZaqEmhENt:wVoXcw2FpZ+9egiU0iofEmG/

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	vvuacult.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Live Messenger.lnk	vvuacult.exe

Executes dropped EXE 1 IoCs

pid	Process
2828	vvuacult.exe

Loads dropped DLL 2 IoCs

pid	Process
1756	2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe
2828	vvuacult.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MsnMsg.eXe	2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe
File opened for modification	C:\Windows\SysWOW64\MsnMsg.eXe	2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe
File created	C:\Windows\SysWOW64\vvuacult.exe	2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2828	1756	2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe	30
PID 1756 wrote to memory of 2828	1756	2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe	30
PID 1756 wrote to memory of 2828	1756	2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe	30
PID 1756 wrote to memory of 2828	1756	2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe	30
PID 2828 wrote to memory of 2472	2828	vvuacult.exe	31
PID 2828 wrote to memory of 2472	2828	vvuacult.exe	31
PID 2828 wrote to memory of 2472	2828	vvuacult.exe	31
PID 2828 wrote to memory of 2472	2828	vvuacult.exe	31
PID 2828 wrote to memory of 2600	2828	vvuacult.exe	32
PID 2828 wrote to memory of 2600	2828	vvuacult.exe	32
PID 2828 wrote to memory of 2600	2828	vvuacult.exe	32
PID 2828 wrote to memory of 2600	2828	vvuacult.exe	32
PID 2600 wrote to memory of 2464	2600	cmd.exe	35
PID 2600 wrote to memory of 2464	2600	cmd.exe	35
PID 2600 wrote to memory of 2464	2600	cmd.exe	35
PID 2600 wrote to memory of 2464	2600	cmd.exe	35
PID 2472 wrote to memory of 2500	2472	cmd.exe	36
PID 2472 wrote to memory of 2500	2472	cmd.exe	36
PID 2472 wrote to memory of 2500	2472	cmd.exe	36
PID 2472 wrote to memory of 2500	2472	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe
"C:\Users\Admin\AppData\Local\Temp\2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\vvuacult.exe
  C:\Windows\System32\vvuacult.exe
  2⤵
  - Drops file in Drivers directory
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe + command.com /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /f /v SaveZoneInformation /t reg_dword /d 1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /f /v SaveZoneInformation /t reg_dword /d 1
      4⤵
      PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe + command.com /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /f /v LowRiskFileTypes /t reg_sz /d ".exe;"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /f /v LowRiskFileTypes /t reg_sz /d ".exe;"
      4⤵
      PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\MsnMsg.eXe

Filesize
620KB

MD5
5376a226b33db36b51bf85b910071031

SHA1
ee89a2daf45bda00154a181b0713d351a19b6e00

SHA256
2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc

SHA512
38fae7a2ef4ba9d8633dd6898f525a6d4ef91813700eb5b95a4e13dfe6caea8d291eedfd092916a50b401cb9bef24adb2a2878b327a4f00c0590d09948483083

Download Submit
C:\Windows\SysWOW64\vvuacult.exe

Filesize
185KB

MD5
a74dd1e24d9f1af96bebd38246d1160e

SHA1
87f5af52c0ae4f5f70597c579d3f31374c6b870c

SHA256
04e8f6883c5638e91ff588124890dff639bd7b790c601ae25dae87fec7e958df

SHA512
d4bc70b162c39e1bb70100600d61a72daaff7a49f0a9a2c3784767d963f5e3ff951ed2a0c9ae78ba4a7181da07391f15fd704ca455e76e10a136ca51b46fbf93

Download Submit
\Windows\SysWOW64\MsnMsg.eXe

Filesize
620KB

MD5
5376a226b33db36b51bf85b910071031

SHA1
ee89a2daf45bda00154a181b0713d351a19b6e00

SHA256
2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc

SHA512
38fae7a2ef4ba9d8633dd6898f525a6d4ef91813700eb5b95a4e13dfe6caea8d291eedfd092916a50b401cb9bef24adb2a2878b327a4f00c0590d09948483083

Download Submit
\Windows\SysWOW64\vvuacult.exe

Filesize
185KB

MD5
a74dd1e24d9f1af96bebd38246d1160e

SHA1
87f5af52c0ae4f5f70597c579d3f31374c6b870c

SHA256
04e8f6883c5638e91ff588124890dff639bd7b790c601ae25dae87fec7e958df

SHA512
d4bc70b162c39e1bb70100600d61a72daaff7a49f0a9a2c3784767d963f5e3ff951ed2a0c9ae78ba4a7181da07391f15fd704ca455e76e10a136ca51b46fbf93

Download Submit
memory/1756-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1756-1-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1756-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1756-21-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2828-22-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download