f90e1c9e6b95781e92f7f8a215ec407d0dd6eff462919e12b0e7087fb1bc1468

Analysis

max time kernel
121s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36cc5248222eebaa0bf6d7c054ae5174.exe
Size

1.2MB
MD5

36cc5248222eebaa0bf6d7c054ae5174
SHA1

f67e53485c2f347dad9a05a38556781718bd6bac
SHA256

f90e1c9e6b95781e92f7f8a215ec407d0dd6eff462919e12b0e7087fb1bc1468
SHA512

25471a3132fb169ddf8c8e95e57a36beaf41160714b5b6fcb1bd1b55712894cb8e021bd34becdaa3cb56a000abf6af9021c34f935bbf00f777e9895000c1fb7f
SSDEEP

24576:N7lKJGonNEiuuJIQpK20uMqMsWTwRnfnri+EAPHijNTxnsQ1MgbX:ZkI1SK2GqMsyw/rJEeALy

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2804-0-0x0000000000400000-0x000000000071E000-memory.dmp	vmprotect
behavioral1/memory/2804-1-0x0000000000400000-0x000000000071E000-memory.dmp	vmprotect
behavioral1/memory/2804-4-0x0000000000400000-0x000000000071E000-memory.dmp	vmprotect
behavioral1/memory/2804-5-0x0000000000400000-0x000000000071E000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1426051-A619-11EE-8723-CA8D9A91D956} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409995886"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2588	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2804	36cc5248222eebaa0bf6d7c054ae5174.exe
2804	36cc5248222eebaa0bf6d7c054ae5174.exe
2804	36cc5248222eebaa0bf6d7c054ae5174.exe
2804	36cc5248222eebaa0bf6d7c054ae5174.exe
2588	iexplore.exe
2588	iexplore.exe
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2588	2804	36cc5248222eebaa0bf6d7c054ae5174.exe	31
PID 2804 wrote to memory of 2588	2804	36cc5248222eebaa0bf6d7c054ae5174.exe	31
PID 2804 wrote to memory of 2588	2804	36cc5248222eebaa0bf6d7c054ae5174.exe	31
PID 2804 wrote to memory of 2588	2804	36cc5248222eebaa0bf6d7c054ae5174.exe	31
PID 2588 wrote to memory of 1712	2588	iexplore.exe	32
PID 2588 wrote to memory of 1712	2588	iexplore.exe	32
PID 2588 wrote to memory of 1712	2588	iexplore.exe	32
PID 2588 wrote to memory of 1712	2588	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\36cc5248222eebaa0bf6d7c054ae5174.exe
"C:\Users\Admin\AppData\Local\Temp\36cc5248222eebaa0bf6d7c054ae5174.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8960d7b4303e5bc40a9366f41933085

SHA1
fd74c4844846d30449ce0bc79a6bb1b6db44d61c

SHA256
bfed13755ff3b68f5bdbe307884374c1820fa95483a6c4015745ed20d0356ff5

SHA512
b9a81c467d483bd989b58f9249227119feaeb017edc69827d8946bdfb925035f88faae1fb31566e3a28653707367800bf842e23bc1d1e4d4adcd113f2c717acb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eba431faf9a16c840dd0aef441ba4948

SHA1
402d3df0234bfe38e4eeff0478d4113791a0a43e

SHA256
c199220e939a0f5115df0bb81b5829dca5565d66eb9ff64b72869be4dfd35dd4

SHA512
4639b732f22364c9cd5fc92462b988d456ab1020f9f29109d7b8f84c72199253229211aab4aa89d38d7d0abf0478e68b53ab424462c1a49c2227dfb2c9032fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baf9adb6b0e55a3f291baca99c7a28bf

SHA1
503e8d52611677380e3b61e07579d0aa63ce5c16

SHA256
6faa4a8d4a64d112c74329526fdd116e93f6cac64c11ea31f9093bf26e4c6e58

SHA512
1eeca6cad71f0cae4ae6e636c502d5ee6de0c201ffb81cb04127be115b6c9ec30cc55dced4f3fe5879703f41fcb97f57cd2d2b05b2f559659d93835161483c20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e43e03caeb3fcf9eb59068f92339c242

SHA1
f265323592dd1f0d4b48ebe4811c49fa08b76cef

SHA256
79db59d0324cdd6622cf415b292182ab4651a9212c621afbf70d18c945ae6ef2

SHA512
401c4918704260a7c97519e8e2a3db1a7ee2436b9223bb24d1b129cce9dfb08c27e62459f5e3f5dac19170b2779f06fb73cfab7ebe3103f03ff676d87b1ac21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39b2ca583e5cbf106c063c3b12031fca

SHA1
012b420b2d153df45c6dc2c05ff68380c67a5489

SHA256
a47a19186aeeaaa410549d04fb0f9d4c122f26ccc8afbeec3d11c294c09ed0d5

SHA512
c401041378bd12d8db5e01ba3fa11ce17f3b32982ff7e223583e4f61813d91b6ce48828f7d02cec9bb24a8a54f15d38f281936d574c28d0f521c1093697bdc41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59498aa9eb6125a6ccadcbf5868b8d94

SHA1
9e7877bf757e07a2b0f0780e7b5f489d0af2eab6

SHA256
d1085f62354ac9bb04c77904987fd2f0e5068088f90b40c9e1cd7288cf652d3a

SHA512
10f5ea8d09195cd60479d60447ac6cadbdbde02bb409b56d454091874c79bc8817f5448af419f57a891f7a1efb76774b10389e180a34d6b4a156b4b52882a45f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc0eb9b7dd5188d2455f3a7221811cc

SHA1
529d1046611e630b871c55d702ad543815d678a2

SHA256
3d154982223035d0201ee4aaa2433210e34b133c72e656386047db3e91760f8d

SHA512
3cb5fbb3e238c80e0624b864a8ad633a236fa710b26cef4ca2628ddb2c44e491c4cf947cfa8f91426d4eb7bc1a1634c3986fcfa7e2b777e931a3c35bc67757e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d85a392f787cae68492d40c25abebfa

SHA1
80649783a75099993c4f25ecb61e9cdc721546dc

SHA256
5ad6d87cd261259f297fdf3638a3e40f899093ef61ee5c1383b7214ff55c48a6

SHA512
954ebc0b964df3103c8ede307245e6d8350b8b3d3d989af4c18e303b58e2612c238037e34dca3946b6c61b651a1cfac891680ec54273c62f672761d6c6c16e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f824161dfaa0ab65308067aec3fa7c98

SHA1
1d378abe25b281ebbb9996e83f994d8a98779d0b

SHA256
f896d5d3b90121f01c965e3b4c182d7ad569f07412c4f25d2cdaabd8b5a73f79

SHA512
0ab9e16b9352100bb19a8b15f6a785438dc3a30b3dae341f36f7deec9e2b9614dc059dabcfe46baebd7877f48c37358b3267e42b57f98e64ccb63e8eed88ed68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec092e9ab4099af48980af0638c636e6

SHA1
3ee7d6735c8fdbee4cbc2ac4098dba2d76bd3d33

SHA256
a7a56c2084a635610bd138f20065f353ac41ad4bbbceb3bda603b4a1b28a5ea9

SHA512
54ce9a4fb1e41923fd9024af88fe78882a7327a8d1cfce07d0d13ec1f07e3e507fdaed02303ca39e487b4b335a174054ed554b37b2396642221925aa9329722a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab92B1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9331.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2804-5-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/2804-4-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/2804-1-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/2804-0-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download