Analysis Overview
SHA256
4bb5903a85140f18d5513dc4d76af82c4d7fb533a47b52ec80f03fcb8b028e6b
Threat Level: Shows suspicious behavior
The file 4bb5903a85140f18d5513dc4d76af82c4d7fb533a47b52ec80f03fcb8b028e6b was found to be: Shows suspicious behavior.
Malicious Activity Summary
VMProtect packed file
UPX packed file
Enumerates physical storage devices
Unsigned PE
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-26 08:55
Signatures
VMProtect packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-26 08:55
Reported
2024-06-26 08:58
Platform
win10v2004-20240611-en
Max time kernel
134s
Max time network
127s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
VMProtect packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings | C:\Users\Admin\AppData\Local\Temp\4bb5903a85140f18d5513dc4d76af82c4d7fb533a47b52ec80f03fcb8b028e6b.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Processes
C:\Users\Admin\AppData\Local\Temp\4bb5903a85140f18d5513dc4d76af82c4d7fb533a47b52ec80f03fcb8b028e6b.exe
"C:\Users\Admin\AppData\Local\Temp\4bb5903a85140f18d5513dc4d76af82c4d7fb533a47b52ec80f03fcb8b028e6b.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4136,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 123-1254042645.cos.ap-guangzhou.myqcloud.com | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| CN | 159.75.57.69:443 | 123-1254042645.cos.ap-guangzhou.myqcloud.com | tcp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| CN | 159.75.57.35:443 | 123-1254042645.cos.ap-guangzhou.myqcloud.com | tcp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| CN | 159.75.57.36:443 | 123-1254042645.cos.ap-guangzhou.myqcloud.com | tcp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.hao7654.com | udp |
| CN | 123.56.42.174:80 | www.hao7654.com | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.179.89.13.in-addr.arpa | udp |
Files
memory/2380-2-0x0000000001050000-0x0000000001051000-memory.dmp
memory/2380-1-0x0000000001040000-0x0000000001041000-memory.dmp
memory/2380-0-0x0000000001020000-0x0000000001021000-memory.dmp
memory/2380-6-0x0000000000561000-0x000000000089F000-memory.dmp
memory/2380-5-0x00000000010A0000-0x00000000010A1000-memory.dmp
memory/2380-4-0x0000000001090000-0x0000000001091000-memory.dmp
memory/2380-3-0x0000000001080000-0x0000000001081000-memory.dmp
memory/2380-8-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/2380-7-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2380-12-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2380-44-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-46-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-58-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-56-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-59-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2380-60-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2380-61-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2380-52-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-50-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-48-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-42-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-40-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-38-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-36-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-34-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-32-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-30-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-28-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-26-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-20-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-18-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-17-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-16-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-15-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-54-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-24-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-22-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-13-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2380-62-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2380-63-0x0000000000561000-0x000000000089F000-memory.dmp
memory/2380-64-0x0000000000400000-0x0000000000E61000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-26 08:55
Reported
2024-06-26 08:58
Platform
win7-20240221-en
Max time kernel
119s
Max time network
120s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
VMProtect packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Processes
C:\Users\Admin\AppData\Local\Temp\4bb5903a85140f18d5513dc4d76af82c4d7fb533a47b52ec80f03fcb8b028e6b.exe
"C:\Users\Admin\AppData\Local\Temp\4bb5903a85140f18d5513dc4d76af82c4d7fb533a47b52ec80f03fcb8b028e6b.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 123-1254042645.cos.ap-guangzhou.myqcloud.com | udp |
| CN | 159.75.57.36:443 | 123-1254042645.cos.ap-guangzhou.myqcloud.com | tcp |
| CN | 159.75.57.35:443 | 123-1254042645.cos.ap-guangzhou.myqcloud.com | tcp |
| CN | 159.75.57.69:443 | 123-1254042645.cos.ap-guangzhou.myqcloud.com | tcp |
| US | 8.8.8.8:53 | www.hao7654.com | udp |
| CN | 123.56.42.174:80 | www.hao7654.com | tcp |
Files
memory/2864-0-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2864-2-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2864-29-0x0000000000320000-0x0000000000321000-memory.dmp
memory/2864-35-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2864-36-0x0000000000561000-0x000000000089F000-memory.dmp
memory/2864-34-0x0000000000330000-0x0000000000331000-memory.dmp
memory/2864-32-0x0000000000330000-0x0000000000331000-memory.dmp
memory/2864-30-0x0000000000330000-0x0000000000331000-memory.dmp
memory/2864-27-0x0000000000320000-0x0000000000321000-memory.dmp
memory/2864-24-0x0000000000310000-0x0000000000311000-memory.dmp
memory/2864-22-0x0000000000310000-0x0000000000311000-memory.dmp
memory/2864-19-0x0000000000300000-0x0000000000301000-memory.dmp
memory/2864-17-0x0000000000300000-0x0000000000301000-memory.dmp
memory/2864-14-0x0000000000270000-0x0000000000271000-memory.dmp
memory/2864-12-0x0000000000270000-0x0000000000271000-memory.dmp
memory/2864-9-0x0000000000260000-0x0000000000261000-memory.dmp
memory/2864-7-0x0000000000260000-0x0000000000261000-memory.dmp
memory/2864-5-0x0000000000260000-0x0000000000261000-memory.dmp
memory/2864-4-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2864-39-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2864-45-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-55-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-65-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-86-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2864-87-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2864-88-0x0000000000400000-0x0000000000E61000-memory.dmp
memory/2864-63-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-61-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-59-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-57-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-53-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-51-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-49-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-47-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-44-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-40-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-43-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-42-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2864-89-0x0000000000561000-0x000000000089F000-memory.dmp