e9c13dca8e06939d07b2852a32f709eaff68e0fbcb1ea79f290062b3187e4372

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36ef9e70d0f659b5ce3e1f2b12902e0c.exe
Size

148KB
MD5

36ef9e70d0f659b5ce3e1f2b12902e0c
SHA1

06984c25a394e65ff15fe8a069ac9fee49812397
SHA256

e9c13dca8e06939d07b2852a32f709eaff68e0fbcb1ea79f290062b3187e4372
SHA512

e5f607a515ad7c4f2bd7be97a29f47629b2a4ccd2f4dc2bfe975146e552dba61e4d25e05c344884d3a314b62842d1210c0b3a4e0881344842dce39a040892f3d
SSDEEP

3072:gSCcW8hywakr39rAbU/XYaDJy1St9x2bANkgXyL6oILtYvFIy:gSg8hywasIaB2cKLULte

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2184	Vvyria.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\5GUTNY6MFK = "C:\\Windows\\Vvyria.exe"	Vvyria.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	36ef9e70d0f659b5ce3e1f2b12902e0c.exe
File opened for modification	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	36ef9e70d0f659b5ce3e1f2b12902e0c.exe
File created	C:\Windows\Vvyria.exe	36ef9e70d0f659b5ce3e1f2b12902e0c.exe
File opened for modification	C:\Windows\Vvyria.exe	36ef9e70d0f659b5ce3e1f2b12902e0c.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	Vvyria.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International	Vvyria.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe
2184	Vvyria.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2184	2632	36ef9e70d0f659b5ce3e1f2b12902e0c.exe	28
PID 2632 wrote to memory of 2184	2632	36ef9e70d0f659b5ce3e1f2b12902e0c.exe	28
PID 2632 wrote to memory of 2184	2632	36ef9e70d0f659b5ce3e1f2b12902e0c.exe	28
PID 2632 wrote to memory of 2184	2632	36ef9e70d0f659b5ce3e1f2b12902e0c.exe	28

C:\Users\Admin\AppData\Local\Temp\36ef9e70d0f659b5ce3e1f2b12902e0c.exe
"C:\Users\Admin\AppData\Local\Temp\36ef9e70d0f659b5ce3e1f2b12902e0c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\Vvyria.exe
  C:\Windows\Vvyria.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job

Filesize
344B

MD5
699c63f23ec944adf6797bdaa58d0694

SHA1
5ab7aa95aef5b433c1865d3912ec154bd58e47fe

SHA256
ffb367b4d44ad8249f00517305badc44e94659b8c39b609989c3d55f4b001509

SHA512
0323b11b38dd93b2d06518089fa09db9c221ff49e5e6c15c553f0c9d0cd13106963ff932bda85b2644bbe3dbf4dbcfdd6cd9873899911a5ee22064ade64ce9a8

Download Submit
C:\Windows\Vvyria.exe

Filesize
73KB

MD5
a40aada56256d1c1e407aeaaace5cec9

SHA1
ff24f632865c436cb3187e8b4c7ef7350d16e359

SHA256
b8834f6487e845c04f959a077877b09ea106ca2c9b9b3c3c8d87def075e5e9e8

SHA512
aa69e5e6d6487b5b47352a48d64cee564d4f798401301e8f66a70fe808b00e65f6c9d0ab3dfe6a4e5ae75fef257f62934369b6f17272732bc2578a5e99e43a57

Download Submit
memory/2184-54370-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2184-9-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2184-8-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2184-54368-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2184-54372-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2184-54374-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2184-54375-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2184-54379-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2632-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2632-44079-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2632-54369-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2632-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download