1ad3cb82fa8909346107c1731bc1a7998967db7d6bd889d3b04cdfa6a97cf4ce

Analysis

max time kernel
91s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VMProtect 3.8.1/VMProtect_Ext64.dll
Size

226KB
MD5

03f91a9f0ae86664d28c1c2267ec429b
SHA1

e4c0847c62a1ee492ba48671b66b280579be3bae
SHA256

06c5896b3c704061847140d439553f6d9c2f8f8bf2c74f429a668d95574097ad
SHA512

ddc03634ba18cb70240b6d40cc261684340048aec9acee3d1cff05ac2909bbd7cd0bfed4fb08eb4e8494d15069850b6bc260241918010c1104cc8b16f3361a3e
SSDEEP

3072:OXep6V+Hiwesaje/gwINrc1yUyhxQLFGCm8EMq:FVNaq4bkC3QLgC5q

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6416B534-5A38-47BA-A8DB-4253F49DC7D3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6416B534-5A38-47BA-A8DB-4253F49DC7D3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VMProtect 3.8.1\\VMProtect_Ext64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6416B534-5A38-47BA-A8DB-4253F49DC7D3}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\VMProtect	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\VMProtect\ = "{6416B534-5A38-47BA-A8DB-4253F49DC7D3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6416B534-5A38-47BA-A8DB-4253F49DC7D3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6416B534-5A38-47BA-A8DB-4253F49DC7D3}\ = "VMProtect Shell Extension"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\VMProtect 3.8.1\VMProtect_Ext64.dll"
1⤵
- Modifies registry class
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads