d82e82550673b3a0bc627c4d3ba6c2ebb9b686eda161ae5d26f95a3720d8c8ec

Reason

Machine shutdown

General

Target

cb5e3b56f8724fd8efcfc57633fb2980N.exe
Size

4.5MB
MD5

cb5e3b56f8724fd8efcfc57633fb2980
SHA1

99a4a87d94a1e7760ee1ca5039e6b5a79d342010
SHA256

d82e82550673b3a0bc627c4d3ba6c2ebb9b686eda161ae5d26f95a3720d8c8ec
SHA512

2fdfedd48e4e76e4c7b9d5f9a2a1a28da505d6e894f98023f2823faf97c937b189ac26410732bd62891069d87723515edcb55bcf83b5725997bd4f369593219b
SSDEEP

98304:W3AuxziZNLsJvb0qKMbDgYlARHHMt01wjIm4rJwaUI0sRUUckyoXII:uTzoJAbP3Dg1wErRUjscoX

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1552-0-0x0000000000410000-0x0000000000D9A000-memory.dmp	vmprotect
behavioral2/memory/1552-2-0x0000000000410000-0x0000000000D9A000-memory.dmp	vmprotect
behavioral2/memory/1552-6-0x0000000000410000-0x0000000000D9A000-memory.dmp	vmprotect
behavioral2/memory/1552-8-0x0000000000410000-0x0000000000D9A000-memory.dmp	vmprotect
behavioral2/memory/1552-13-0x0000000000410000-0x0000000000D9A000-memory.dmp	vmprotect
behavioral2/memory/1552-14-0x0000000000410000-0x0000000000D9A000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\HYDati.dll	cb5e3b56f8724fd8efcfc57633fb2980N.exe
File created	C:\Windows\mydll.dll	cb5e3b56f8724fd8efcfc57633fb2980N.exe
File created	C:\Windows\Ldll.dll	cb5e3b56f8724fd8efcfc57633fb2980N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb5e3b56f8724fd8efcfc57633fb2980N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4616	ipconfig.exe
2844	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	cb5e3b56f8724fd8efcfc57633fb2980N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	cb5e3b56f8724fd8efcfc57633fb2980N.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\IESettingSync	cb5e3b56f8724fd8efcfc57633fb2980N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	cb5e3b56f8724fd8efcfc57633fb2980N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe
1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe
1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe
1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe
1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe
1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2396	1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe	88
PID 1552 wrote to memory of 2396	1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe	88
PID 1552 wrote to memory of 2396	1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe	88
PID 1552 wrote to memory of 772	1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe	89
PID 1552 wrote to memory of 772	1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe	89
PID 1552 wrote to memory of 772	1552	cb5e3b56f8724fd8efcfc57633fb2980N.exe	89
PID 2396 wrote to memory of 4780	2396	cmd.exe	92
PID 2396 wrote to memory of 4780	2396	cmd.exe	92
PID 2396 wrote to memory of 4780	2396	cmd.exe	92
PID 2396 wrote to memory of 3116	2396	cmd.exe	93
PID 2396 wrote to memory of 3116	2396	cmd.exe	93
PID 2396 wrote to memory of 3116	2396	cmd.exe	93
PID 2396 wrote to memory of 4444	2396	cmd.exe	94
PID 2396 wrote to memory of 4444	2396	cmd.exe	94
PID 2396 wrote to memory of 4444	2396	cmd.exe	94
PID 772 wrote to memory of 3084	772	cmd.exe	95
PID 772 wrote to memory of 3084	772	cmd.exe	95
PID 772 wrote to memory of 3084	772	cmd.exe	95
PID 772 wrote to memory of 3080	772	cmd.exe	96
PID 772 wrote to memory of 3080	772	cmd.exe	96
PID 772 wrote to memory of 3080	772	cmd.exe	96
PID 2396 wrote to memory of 4616	2396	cmd.exe	97
PID 2396 wrote to memory of 4616	2396	cmd.exe	97
PID 2396 wrote to memory of 4616	2396	cmd.exe	97
PID 772 wrote to memory of 1636	772	cmd.exe	98
PID 772 wrote to memory of 1636	772	cmd.exe	98
PID 772 wrote to memory of 1636	772	cmd.exe	98
PID 772 wrote to memory of 2844	772	cmd.exe	99
PID 772 wrote to memory of 2844	772	cmd.exe	99
PID 772 wrote to memory of 2844	772	cmd.exe	99

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4444	attrib.exe
1636	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cb5e3b56f8724fd8efcfc57633fb2980N.exe
"C:\Users\Admin\AppData\Local\Temp\cb5e3b56f8724fd8efcfc57633fb2980N.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ECHO y|cacls %windir%\System32\drivers\etc\hosts /g everyone:f & attrib /s /d -s -h %windir%\System32\drivers\etc\hosts & move hosts %windir%\System32\drivers\etc\ & ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4780
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\System32\drivers\etc\hosts /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3116
- - C:\Windows\SysWOW64\attrib.exe
    attrib /s /d -s -h C:\Windows\System32\drivers\etc\hosts
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4444
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ECHO y|cacls %windir%\System32\drivers\etc\hosts /g everyone:f & attrib /s /d -s -h %windir%\System32\drivers\etc\hosts & move hosts %windir%\System32\drivers\etc\ & ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3084
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\System32\drivers\etc\hosts /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3080
- - C:\Windows\SysWOW64\attrib.exe
    attrib /s /d -s -h C:\Windows\System32\drivers\etc\hosts
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1636
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hosts

Filesize
1KB

MD5
008fba141529811128b8cd5f52300f6e

SHA1
1a350b35d82cb4bd7a924b6840c36a678105f793

SHA256
ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84

SHA512
80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc

Download Submit
memory/1552-0-0x0000000000410000-0x0000000000D9A000-memory.dmp

Filesize
9.5MB

Download
memory/1552-1-0x0000000000411000-0x0000000000548000-memory.dmp

Filesize
1.2MB

Download
memory/1552-2-0x0000000000410000-0x0000000000D9A000-memory.dmp

Filesize
9.5MB

Download
memory/1552-6-0x0000000000410000-0x0000000000D9A000-memory.dmp

Filesize
9.5MB

Download
memory/1552-8-0x0000000000410000-0x0000000000D9A000-memory.dmp

Filesize
9.5MB

Download
memory/1552-13-0x0000000000410000-0x0000000000D9A000-memory.dmp

Filesize
9.5MB

Download
memory/1552-14-0x0000000000410000-0x0000000000D9A000-memory.dmp

Filesize
9.5MB

Download

Analysis

Sharing

Errors