Analysis Overview
SHA256
cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd
Threat Level: Shows suspicious behavior
The file cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd was found to be: Shows suspicious behavior.
Malicious Activity Summary
VMProtect packed file
Adds Run key to start application
Unsigned PE
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-12-06 14:21
Signatures
VMProtect packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-06 14:21
Reported
2023-12-06 14:24
Platform
win7-20231020-en
Max time kernel
117s
Max time network
121s
Command Line
Signatures
VMProtect packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\CareUEyes = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe /tray" | C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\Wow6432Node\CLSID\{FC36FD6A-7586-4ad1-8CBF-EB8AB7A51533} | C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\Wow6432Node | C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\Wow6432Node\CLSID | C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\Wow6432Node\CLSID\{FC36FD6A-7586-4ad1-8CBF-EB8AB7A51533}\uuid = "ZjViNTQyZWZjYzE5MjY5MGEzODI2MzI5MThjMTUzMjk=" | C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Processes
C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe
"C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe"
Network
Files
memory/2216-0-0x0000000000080000-0x0000000000081000-memory.dmp
memory/2216-3-0x0000000001360000-0x0000000002722000-memory.dmp
memory/2216-2-0x0000000000080000-0x0000000000081000-memory.dmp
memory/2216-5-0x0000000000080000-0x0000000000081000-memory.dmp
memory/2216-7-0x0000000001360000-0x0000000002722000-memory.dmp
memory/2216-6-0x00000000000E0000-0x00000000000E1000-memory.dmp
memory/2216-9-0x00000000000E0000-0x00000000000E1000-memory.dmp
memory/2216-11-0x00000000000E0000-0x00000000000E1000-memory.dmp
memory/2216-24-0x0000000000110000-0x0000000000111000-memory.dmp
memory/2216-21-0x0000000000100000-0x0000000000101000-memory.dmp
memory/2216-26-0x0000000000110000-0x0000000000111000-memory.dmp
memory/2216-19-0x0000000000100000-0x0000000000101000-memory.dmp
memory/2216-16-0x00000000000F0000-0x00000000000F1000-memory.dmp
memory/2216-14-0x00000000000F0000-0x00000000000F1000-memory.dmp
memory/2216-29-0x0000000000120000-0x0000000000121000-memory.dmp
memory/2216-31-0x0000000000120000-0x0000000000121000-memory.dmp
memory/2216-36-0x0000000000130000-0x0000000000131000-memory.dmp
memory/2216-34-0x0000000000130000-0x0000000000131000-memory.dmp
memory/2216-38-0x0000000077C90000-0x0000000077C91000-memory.dmp
memory/2216-32-0x0000000000130000-0x0000000000131000-memory.dmp
memory/2216-41-0x0000000036000000-0x0000000036010000-memory.dmp
memory/2216-42-0x0000000003D00000-0x0000000003D40000-memory.dmp
C:\Users\Admin\AppData\Roaming\careueyes\setting_v2.dat
| MD5 | 44f6bcaf5ec30dc007ee91394b7954fc |
| SHA1 | dd8b077395cca86e0b95136666c454d084937649 |
| SHA256 | b9643ce33183728a6050277ecab47d9bd65a1fc2d89351d46ff7fe669a5e72c3 |
| SHA512 | 4cdd69d091db8dce059b6526a6f47f4e8acc67e1e9f1330b0441e4c02895ea1bfc7b7f64c43c161a74ca4eb103f476f2b3ca731571adba4f0f768d80621ccb69 |
memory/2216-62-0x0000000001360000-0x0000000002722000-memory.dmp
memory/2216-63-0x0000000003D00000-0x0000000003D40000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-06 14:21
Reported
2023-12-06 14:24
Platform
win10v2004-20231201-en
Max time kernel
90s
Max time network
149s
Command Line
Signatures
VMProtect packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CareUEyes = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe /tray" | C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000_Classes\WOW6432Node\CLSID\{FC36FD6A-7586-4ad1-8CBF-EB8AB7A51533} | C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000_Classes\WOW6432Node\CLSID\{FC36FD6A-7586-4ad1-8CBF-EB8AB7A51533}\uuid = "OTdkNmE2Y2ExMmYzMDc4M2I1NDg4ZDIwMTNhMTc0MDI=" | C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Processes
C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe
"C:\Users\Admin\AppData\Local\Temp\cdf546e4658cdd7867891bca27ff35fcf59d74869ad27bd86a809f2dde788bcd.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 21.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 177.178.17.96.in-addr.arpa | udp |
Files
memory/4864-0-0x0000000001FA0000-0x0000000001FA1000-memory.dmp
memory/4864-2-0x0000000000240000-0x0000000001602000-memory.dmp
memory/4864-3-0x0000000001FF0000-0x0000000001FF1000-memory.dmp
memory/4864-4-0x0000000002000000-0x0000000002001000-memory.dmp
memory/4864-1-0x0000000001FC0000-0x0000000001FC1000-memory.dmp
memory/4864-6-0x0000000000240000-0x0000000001602000-memory.dmp
memory/4864-5-0x0000000002010000-0x0000000002011000-memory.dmp
memory/4864-7-0x0000000002020000-0x0000000002021000-memory.dmp
memory/4864-9-0x0000000002030000-0x0000000002031000-memory.dmp
memory/4864-13-0x0000000036DE0000-0x0000000036DF0000-memory.dmp
memory/4864-14-0x00000000040D0000-0x00000000040E0000-memory.dmp
C:\Users\Admin\AppData\Roaming\careueyes\setting_v2.dat
| MD5 | 48ac597f5f39cdf13539f7c1463f2375 |
| SHA1 | a82bf316bb080735c504ee0d7a44b5af2b22624c |
| SHA256 | 235b367a97c40de1cb2ba11cba06ab5d498019eed301cc35e83ee0689be2c9cb |
| SHA512 | 8dcad702983115811202f4d9024e9e97c9f5e1a4d85045775749212da0c80b52d80e5f4f10481e1850988cc33c51d3fa8e5d535d353ad854b2eefeb2e303df7f |
memory/4864-34-0x0000000000240000-0x0000000001602000-memory.dmp
memory/4864-35-0x00000000040D0000-0x00000000040E0000-memory.dmp