c1c32cadd25039c3d2c7c2f73b702d33a1ce437b680d4dc3d2c8b8734ddc2773

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe
Size

1.2MB
MD5

00234e7f7a8ad4d80445524d21d08acc
SHA1

03d25774b43bb1d58e3ab596fe0969b74dfd8f01
SHA256

c1c32cadd25039c3d2c7c2f73b702d33a1ce437b680d4dc3d2c8b8734ddc2773
SHA512

572bea56fcd77edf68eb892e8535f9b775ae5aea4f2047edea43a95f80a50d0760d8f000ed2a304a1e3fa1900bdb8d22750221a3f2be9b6f09d9569958086544
SSDEEP

24576:MORBrk2kqz3mSEfq/aPBO1hi81cRI+oTEAAciZx9/Xd/B:rrD9WSEfbg111QopLM/t

Score

9^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 3 IoCs

resource	yara_rule
behavioral1/memory/1404-0-0x0000000000400000-0x0000000000665000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/1404-1-0x0000000000400000-0x0000000000665000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/1404-32-0x0000000000400000-0x0000000000665000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1404-0-0x0000000000400000-0x0000000000665000-memory.dmp	vmprotect
behavioral1/memory/1404-1-0x0000000000400000-0x0000000000665000-memory.dmp	vmprotect
behavioral1/memory/1404-32-0x0000000000400000-0x0000000000665000-memory.dmp	vmprotect

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mangafull.com/Buscador/BuscadorTotal.htm"	VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1404	VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe
1404	VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe
1404	VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe

C:\Users\Admin\AppData\Local\Temp\VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare-00234e7f7a8ad4d80445524d21d08acc.exe"
1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-0-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/1404-1-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/1404-6-0x00000000047D0000-0x0000000005832000-memory.dmp

Filesize
16.4MB

Download
memory/1404-32-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads