e971dbd6023b6b131b6eb7d5dca6a7659224cf8005291e4b9a675d65c39e3ace

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6edb98faf700c660687add7a4c0b1d49.exe
Size

808KB
MD5

6edb98faf700c660687add7a4c0b1d49
SHA1

bb1dadcf812f4f7082b815c059f144c1dffa223b
SHA256

e971dbd6023b6b131b6eb7d5dca6a7659224cf8005291e4b9a675d65c39e3ace
SHA512

fb843c78975dce6a1e717da3eaeaff02686633eb5088b18cc83b1855324c19be7a2c1f947f69c1def9ac6a413b4503cdec86d35bfd0bf688dd96db8afd2b12ad
SSDEEP

12288:1RMOrqg9i+V5UxZDCSFf2TBD79hZ/l7k3wF+yggl24DU4X4875/DpC1sysbA:DMOrqetS10nY3wfgOl75/QsU

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1484-0-0x0000000000400000-0x00000000006C7000-memory.dmp	vmprotect
behavioral1/memory/1484-1-0x0000000000400000-0x00000000006C7000-memory.dmp	vmprotect
behavioral1/memory/1484-13-0x0000000000400000-0x00000000006C7000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	6edb98faf700c660687add7a4c0b1d49.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	6edb98faf700c660687add7a4c0b1d49.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	6edb98faf700c660687add7a4c0b1d49.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1484	6edb98faf700c660687add7a4c0b1d49.exe
1484	6edb98faf700c660687add7a4c0b1d49.exe
1484	6edb98faf700c660687add7a4c0b1d49.exe
1484	6edb98faf700c660687add7a4c0b1d49.exe

C:\Users\Admin\AppData\Local\Temp\6edb98faf700c660687add7a4c0b1d49.exe
"C:\Users\Admin\AppData\Local\Temp\6edb98faf700c660687add7a4c0b1d49.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-0-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/1484-1-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/1484-13-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download