Overview

overview

10

Static

static

10

Proxy_Tool...rs.rar

windows7-x64

7

Proxy_Tool...rs.rar

windows10-2004-x64

1

Proxy Tool...an.txt

windows7-x64

1

Proxy Tool...an.txt

windows10-2004-x64

1

Proxy Tool...og.txt

windows7-x64

1

Proxy Tool...og.txt

windows10-2004-x64

1

Proxy Tool...ip.dll

windows7-x64

1

Proxy Tool...ip.dll

windows10-2004-x64

1

Proxy Tool...CE.zip

windows7-x64

8

Proxy Tool...CE.zip

windows10-2004-x64

1

Proxy Tool...er.exe

windows7-x64

8

Proxy Tool...er.exe

windows10-2004-x64

8

Proxy Tool...ME.txt

windows7-x64

1

Proxy Tool...ME.txt

windows10-2004-x64

1

Proxy Tool...te.dll

windows7-x64

3

Proxy Tool...te.dll

windows10-2004-x64

3

Proxy Tool...og.txt

windows7-x64

1

Proxy Tool...og.txt

windows10-2004-x64

1

Proxy Tool...xy.exe

windows7-x64

3

Proxy Tool...xy.exe

windows10-2004-x64

3

Proxy Tool...xy.exe

windows7-x64

8

Proxy Tool...xy.exe

windows10-2004-x64

8

Proxy Tool...ce.txt

windows7-x64

1

Proxy Tool...ce.txt

windows10-2004-x64

1

Proxy Tool...ce.txt

windows7-x64

1

Proxy Tool...ce.txt

windows10-2004-x64

1

Proxy Tool...op.ini

windows7-x64

1

Proxy Tool...op.ini

windows10-2004-x64

1

Proxy Tool...an.txt

windows7-x64

1

Proxy Tool...an.txt

windows10-2004-x64

1

Proxy Tool...ck.ini

windows7-x64

1

Proxy Tool...ck.ini

windows10-2004-x64

1

Analysis

  • max time kernel
    144s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28-10-2024 16:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Proxy Tools and Grabbers/vProxy v1.4 by Yani/data/Launcher.exe

  • Size

    53KB

  • MD5

    c6d4c881112022eb30725978ecd7c6ec

  • SHA1

    ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

  • SHA256

    0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

  • SHA512

    3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

  • SSDEEP

    768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 1 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 51 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Proxy Tools and Grabbers\vProxy v1.4 by Yani\data\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Proxy Tools and Grabbers\vProxy v1.4 by Yani\data\Launcher.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2316
    • C:\Windows\IMF\Windows Services.exe
      "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Windows\IMF\Secure System Shell.exe
        "C:\Windows\IMF\Secure System Shell.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2976
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2492
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2312
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2792
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:476
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:780
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1428
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2076
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2092
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2356
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1632
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:704
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2808
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2940
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2040
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1804
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1752
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2128
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1224
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1816
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2380
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2396
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2324
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2840
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\IMF\Runtime Explorer.exe
    Filesize

    152KB

    MD5

    03f5e0141f4519f0c5ac26ce0b036a0f

    SHA1

    4f7a2a230e7a194a898cc9f2d563ac8777fe99c0

    SHA256

    78a408c628e33e3332645f480ee7ce01b5dc24fc96cf16ffa0868d43f3d421ef

    SHA512

    86a68f040654006e06b51c5714e0d7168d0d1bef7f3c39843632068104f773f771d21be4bc251d712f3e915cd1058f89ad31d9e3f3d9e7cf6da6785cbf22d8d7

    Download Submit

  • C:\Windows\IMF\Secure System Shell.exe
    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

    Download Submit

  • C:\Windows\IMF\Windows Services.exe
    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

    Download Submit

  • memory/1984-0-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1984-1-0x0000000000160000-0x0000000000174000-memory.dmp

    Filesize

    80KB

    Download

  • memory/1984-2-0x0000000074AF0000-0x00000000751DE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1984-3-0x0000000000990000-0x0000000000A0E000-memory.dmp

    Filesize

    504KB

    Download

  • memory/1984-4-0x0000000074AF0000-0x00000000751DE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1984-39-0x0000000074AF0000-0x00000000751DE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2856-38-0x00000000012F0000-0x0000000001302000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2976-49-0x0000000000A90000-0x0000000000AA2000-memory.dmp

    Filesize

    72KB

    Download