Analysis
-
max time kernel
51s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e4904f3254b61e2846de012c3098950N.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
9e4904f3254b61e2846de012c3098950N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
9e4904f3254b61e2846de012c3098950N.exe
-
Size
134KB
-
MD5
9e4904f3254b61e2846de012c3098950
-
SHA1
d0f222b628953b8884b5c1b11a80caacfeb6d7ed
-
SHA256
716d25821990cbfb9c7c906961e9f9ac7c8549ceb1066f753ff8c13fa799e1f8
-
SHA512
235fdc5c839545284952319c6a7f371fc3fca32695cdd6777b4e7127975e5336c4f2bb8bac4609e45ecda91734985ef35cda829be1019ca771c10cf837528d6a
-
SSDEEP
1536:iPQc0IiI+7vAIIzuQ8Tr15WUkTdIOzq0ZDYnJvx/45YssAe8d2wNmlFIhF9Vt:MQc01zAf6QGkBIO20Z2vQYeo7Ihf3
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9e4904f3254b61e2846de012c3098950N.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dvm.exe -
Executes dropped EXE 6 IoCs
pid Process 2336 dvm.exe 1852 dvm.exe 2104 dvm.exe 2664 winvsp.exe 936 dvm.exe 1804 dvm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winvsp = "c:\\windows\\system32\\winvsp.exe" 9e4904f3254b61e2846de012c3098950N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcvsp = "c:\\windows\\system32\\svcvsp.exe" 9e4904f3254b61e2846de012c3098950N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winvsp = "c:\\windows\\system32\\winvsp.exe" dvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcvsp = "c:\\windows\\system32\\svcvsp.exe" dvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcvsp = "c:\\windows\\system32\\svcvsp.exe" dvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vspmem = "c:\\windows\\system32\\vspmem.exe" 9e4904f3254b61e2846de012c3098950N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmcsp = "c:\\windows\\system32\\wmcsp.exe" 9e4904f3254b61e2846de012c3098950N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vspmem = "c:\\windows\\system32\\vspmem.exe" dvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmcsp = "c:\\windows\\system32\\wmcsp.exe" dvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winvsp = "c:\\windows\\system32\\winvsp.exe" dvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vspmem = "c:\\windows\\system32\\vspmem.exe" dvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmcsp = "c:\\windows\\system32\\wmcsp.exe" dvm.exe -
Drops file in System32 directory 49 IoCs
description ioc Process File opened for modification \??\c:\windows\system32\vspmng.exe dvm.exe File opened for modification \??\c:\windows\system32\dvm.exe dvm.exe File opened for modification \??\c:\windows\system32\RCXC9F8.tmp dvm.exe File opened for modification \??\c:\windows\system32\dvm.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\RCXC9C5.tmp dvm.exe File opened for modification \??\c:\windows\system32\vspmng.exe dvm.exe File opened for modification C:\Windows\system32\vspconsole.exe dvm.exe File created \??\c:\windows\system32\vspconsole.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\vspconsole.exe 9e4904f3254b61e2846de012c3098950N.exe File created \??\c:\windows\system32\dvm.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\wmcsp.exe dvm.exe File opened for modification \??\c:\windows\system32\RCXA1DB.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\svcvsp.exe dvm.exe File created \??\c:\windows\system32\svcvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\vspconsole.exe dvm.exe File opened for modification \??\c:\windows\system32\RCXC9D6.tmp dvm.exe File opened for modification \??\c:\windows\system32\vspmng.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\vspmem.exe dvm.exe File opened for modification \??\c:\windows\system32\winvsp.exe dvm.exe File opened for modification \??\c:\windows\system32\winvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\RCXA1EC.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\svcvsp.exe dvm.exe File created \??\c:\windows\system32\winvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File created \??\c:\windows\system32\vspmng.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification C:\Windows\system32\winvsp.exe dvm.exe File created \??\c:\windows\system32\winvsp.exe dvm.exe File opened for modification \??\c:\windows\system32\RCXA1FF.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification C:\Windows\system32\vspmem.exe dvm.exe File opened for modification C:\Windows\system32\svcvsp.exe dvm.exe File opened for modification \??\c:\windows\system32\vspmem.exe dvm.exe File opened for modification \??\c:\windows\system32\RCXC9D5.tmp dvm.exe File opened for modification \??\c:\windows\system32\RCXA1DC.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\RCXA1ED.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification C:\Windows\system32\dvm.exe dvm.exe File opened for modification \??\c:\windows\system32\RCXC9D7.tmp dvm.exe File opened for modification \??\c:\windows\system32\RCXC9D8.tmp dvm.exe File opened for modification \??\c:\windows\system32\wmcsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification C:\Windows\system32\wmcsp.exe dvm.exe File opened for modification C:\Windows\system32\vspmng.exe dvm.exe File opened for modification \??\c:\windows\system32\dvm.exe dvm.exe File opened for modification \??\c:\windows\system32\winvsp.exe dvm.exe File opened for modification \??\c:\windows\system32\vspconsole.exe dvm.exe File opened for modification \??\c:\windows\system32\wmcsp.exe dvm.exe File opened for modification \??\c:\windows\system32\svcvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File created \??\c:\windows\system32\wmcsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\RCXA200.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\vspmem.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\system32\RCXA1EE.tmp 9e4904f3254b61e2846de012c3098950N.exe File created \??\c:\windows\system32\vspmem.exe 9e4904f3254b61e2846de012c3098950N.exe -
Drops file in Program Files directory 28 IoCs
description ioc Process File opened for modification \??\c:\program files\wmcsp.exe dvm.exe File opened for modification \??\c:\program files\vspconsole.exe dvm.exe File opened for modification \??\c:\program files\winvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File created \??\c:\program files\vspconsole.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\dvm.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\dvm.exe dvm.exe File created \??\c:\program files\vspmng.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\vspmem.exe dvm.exe File opened for modification \??\c:\program files\wmcsp.exe dvm.exe File opened for modification \??\c:\program files\vspmem.exe dvm.exe File opened for modification \??\c:\program files\svcvsp.exe dvm.exe File opened for modification \??\c:\program files\vspmem.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\vspconsole.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\wmcsp.exe 9e4904f3254b61e2846de012c3098950N.exe File created \??\c:\program files\dvm.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\winvsp.exe dvm.exe File created \??\c:\program files\winvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File created \??\c:\program files\svcvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\vspconsole.exe dvm.exe File opened for modification \??\c:\program files\vspmng.exe dvm.exe File opened for modification \??\c:\program files\dvm.exe dvm.exe File created \??\c:\program files\vspmem.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\svcvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\vspmng.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\vspmng.exe dvm.exe File opened for modification \??\c:\program files\winvsp.exe dvm.exe File created \??\c:\program files\wmcsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\program files\svcvsp.exe dvm.exe -
Drops file in Windows directory 42 IoCs
description ioc Process File opened for modification \??\c:\windows\vspconsole.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\vspmng.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\wmcsp.exe dvm.exe File opened for modification \??\c:\windows\RCXCA2E.tmp dvm.exe File opened for modification \??\c:\windows\winvsp.exe dvm.exe File opened for modification \??\c:\windows\vspmng.exe dvm.exe File created \??\c:\windows\svcvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\svcvsp.exe dvm.exe File opened for modification \??\c:\windows\vspconsole.exe dvm.exe File opened for modification \??\c:\windows\RCXCA09.tmp dvm.exe File opened for modification \??\c:\windows\svcvsp.exe dvm.exe File opened for modification \??\c:\windows\winvsp.exe dvm.exe File opened for modification \??\c:\windows\RCXCA0A.tmp dvm.exe File created \??\c:\windows\winvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\RCXA241.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\wmcsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\RCXA2A2.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\dvm.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\dvm.exe dvm.exe File opened for modification \??\c:\windows\RCXCA1C.tmp dvm.exe File opened for modification \??\c:\windows\vspconsole.exe dvm.exe File opened for modification \??\c:\windows\dvm.exe dvm.exe File opened for modification \??\c:\windows\winvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File created \??\c:\windows\wmcsp.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\RCXA242.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\wmcsp.exe dvm.exe File opened for modification \??\c:\windows\RCXCA0B.tmp dvm.exe File opened for modification \??\c:\windows\RCXCA2C.tmp dvm.exe File opened for modification \??\c:\windows\vspmem.exe dvm.exe File opened for modification \??\c:\windows\RCXCA2D.tmp dvm.exe File opened for modification \??\c:\windows\RCXA201.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\RCXA211.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\RCXA2B2.tmp 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\vspmem.exe dvm.exe File created \??\c:\windows\vspmng.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\vspmng.exe dvm.exe File created \??\c:\windows\vspmem.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\vspmem.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\svcvsp.exe 9e4904f3254b61e2846de012c3098950N.exe File created \??\c:\windows\vspconsole.exe 9e4904f3254b61e2846de012c3098950N.exe File opened for modification \??\c:\windows\RCXA2A1.tmp 9e4904f3254b61e2846de012c3098950N.exe File created \??\c:\windows\dvm.exe 9e4904f3254b61e2846de012c3098950N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden = "2" dvm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ dvm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" dvm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" dvm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached dvm.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e08fdb964cdbda01 dvm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced dvm.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dvm.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2664 winvsp.exe 2664 winvsp.exe 1804 dvm.exe 1804 dvm.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2336 dvm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2664 winvsp.exe Token: SeDebugPrivilege 1804 dvm.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2296 wrote to memory of 908 2296 9e4904f3254b61e2846de012c3098950N.exe 30 PID 2296 wrote to memory of 908 2296 9e4904f3254b61e2846de012c3098950N.exe 30 PID 2296 wrote to memory of 908 2296 9e4904f3254b61e2846de012c3098950N.exe 30 PID 2296 wrote to memory of 2336 2296 9e4904f3254b61e2846de012c3098950N.exe 31 PID 2296 wrote to memory of 2336 2296 9e4904f3254b61e2846de012c3098950N.exe 31 PID 2296 wrote to memory of 2336 2296 9e4904f3254b61e2846de012c3098950N.exe 31 PID 1852 wrote to memory of 2104 1852 dvm.exe 33 PID 1852 wrote to memory of 2104 1852 dvm.exe 33 PID 1852 wrote to memory of 2104 1852 dvm.exe 33 PID 1852 wrote to memory of 2664 1852 dvm.exe 34 PID 1852 wrote to memory of 2664 1852 dvm.exe 34 PID 1852 wrote to memory of 2664 1852 dvm.exe 34 PID 2336 wrote to memory of 936 2336 dvm.exe 35 PID 2336 wrote to memory of 936 2336 dvm.exe 35 PID 2336 wrote to memory of 936 2336 dvm.exe 35 PID 2336 wrote to memory of 1804 2336 dvm.exe 36 PID 2336 wrote to memory of 1804 2336 dvm.exe 36 PID 2336 wrote to memory of 1804 2336 dvm.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e4904f3254b61e2846de012c3098950N.exe"C:\Users\Admin\AppData\Local\Temp\9e4904f3254b61e2846de012c3098950N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\9e4904f3254b61e2846de012c3098950N.exe"C:\Users\Admin\AppData\Local\Temp\9e4904f3254b61e2846de012c3098950N.exe" rg2⤵
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
PID:908
-
-
C:\programdata\dvm.exe"C:\programdata\dvm.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\programdata\dvm.exe"C:\programdata\dvm.exe" rg3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
PID:936
-
-
C:\Users\Admin\Documents\dvm.exe"C:\Users\Admin\Documents\dvm.exe" wm 23363⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
-
C:\programdata\dvm.exe"C:\programdata\dvm.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\programdata\dvm.exe"C:\programdata\dvm.exe" rg2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies data under HKEY_USERS
PID:2104
-
-
C:\Windows\System32\winvsp.exe"C:\Windows\System32\winvsp.exe" ws 1852 winvsp2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29B
MD507d4c0c3bd4031c325814063946ddfd9
SHA112c200bb85943ef2d3e602f8c6ee890c0d01aea5
SHA2564b49d4c40e59c8f82ae9a1bc6ed8c83b3df58167c4d2786650ef6323464ddf0a
SHA51216f6f6819208fbe09ffa51592f2da284b602c45b421eadd823c0214efe9273b656bd81d37cb4dd537e8a76b0ef63f7a86d971b370f0eb020bf8d11d811fa3c0e
-
Filesize
134KB
MD52d4abf17bd2e2cf5e20aba26c45498b3
SHA126fb90c1a1ef4b9ab80d2a010ffd4781f3350b8b
SHA25692bde6d53cff254b11a6cbbdec28f20bd70d4b60a437c789a99b3c4e1f389cc1
SHA512cea862e1a210f27fc137bdc7f9c3c81cf92e24e3e407e7b0eb8990edae06b0ce94a6fa492f2c3a9f4e153d26cd31d2b7f888329130a36bf763f1eb3b6628498a
-
Filesize
134KB
MD58c128fdb021798d913e685cb2a6a37dd
SHA19211b2ccea07c7688e69e0be4eadf5b83c76d4fd
SHA2561009e0f39eec98af2308bb9762804f332286a01917011cba0147696a984f02b2
SHA5121e3255b23163b50902068b53722e53ef96ffc620deb8211c77894fa7d248b6352b49558c13d8a5045393a34ccbdfc8bafdc4920d1cff2e16bd3734ebf0b41556
-
Filesize
134KB
MD59e4904f3254b61e2846de012c3098950
SHA1d0f222b628953b8884b5c1b11a80caacfeb6d7ed
SHA256716d25821990cbfb9c7c906961e9f9ac7c8549ceb1066f753ff8c13fa799e1f8
SHA512235fdc5c839545284952319c6a7f371fc3fca32695cdd6777b4e7127975e5336c4f2bb8bac4609e45ecda91734985ef35cda829be1019ca771c10cf837528d6a