bbc5d2cf7422ee184beaaac9aa920b0cf9a1310cfd703fd0f9b1b63701672df8

Reason

Machine shutdown

General

Target

ProtonVPN_v3.5.3_x64.exe
Size

81.4MB
MD5

9e246caf655fef65deaa2ccb9886fddb
SHA1

e8186d24c2e0011453e0495a69aebfd56635240e
SHA256

bbc5d2cf7422ee184beaaac9aa920b0cf9a1310cfd703fd0f9b1b63701672df8
SHA512

f1c6e86c681329feda4db846125356ed29c85a97c65db2e4f66411763b13e844bb947b77c2e7e904f1cb5ae12868d4a133e8573557f477fd147952a942a259e2
SSDEEP

1572864:pVuySnEkGve5KGOIBvwOiHmg4qy5A47s5ECkAz0Ii/VjSuHk26ndjpj69FoFYlwu:WySJme5OswOdn3cw7jjHD9FmYh

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2788	ProtonVPN_v3.5.3_x64.tmp

Loads dropped DLL 2 IoCs

pid	Process
2716	ProtonVPN_v3.5.3_x64.exe
2788	ProtonVPN_v3.5.3_x64.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProtonVPN_v3.5.3_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProtonVPN_v3.5.3_x64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A2CE101-0BB8-11F0-ABFC-465533733A50} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2828	iexplore.exe
2828	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2788	2716	ProtonVPN_v3.5.3_x64.exe	30
PID 2716 wrote to memory of 2788	2716	ProtonVPN_v3.5.3_x64.exe	30
PID 2716 wrote to memory of 2788	2716	ProtonVPN_v3.5.3_x64.exe	30
PID 2716 wrote to memory of 2788	2716	ProtonVPN_v3.5.3_x64.exe	30
PID 2716 wrote to memory of 2788	2716	ProtonVPN_v3.5.3_x64.exe	30
PID 2716 wrote to memory of 2788	2716	ProtonVPN_v3.5.3_x64.exe	30
PID 2716 wrote to memory of 2788	2716	ProtonVPN_v3.5.3_x64.exe	30
PID 2788 wrote to memory of 2828	2788	ProtonVPN_v3.5.3_x64.tmp	31
PID 2788 wrote to memory of 2828	2788	ProtonVPN_v3.5.3_x64.tmp	31
PID 2788 wrote to memory of 2828	2788	ProtonVPN_v3.5.3_x64.tmp	31
PID 2788 wrote to memory of 2828	2788	ProtonVPN_v3.5.3_x64.tmp	31
PID 2828 wrote to memory of 2800	2828	iexplore.exe	32
PID 2828 wrote to memory of 2800	2828	iexplore.exe	32
PID 2828 wrote to memory of 2800	2828	iexplore.exe	32
PID 2828 wrote to memory of 2800	2828	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.5.3_x64.exe
"C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.5.3_x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\is-LV48J.tmp\ProtonVPN_v3.5.3_x64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LV48J.tmp\ProtonVPN_v3.5.3_x64.tmp" /SL5="$40144,84282447,1033216,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.5.3_x64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://protonvpn.com/free-vpn/windows/windows7
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2828 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2800

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2880

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-LV48J.tmp\ProtonVPN_v3.5.3_x64.tmp

Filesize
3.2MB

MD5
55ed3791796c4f7327512ee86c81c7dd

SHA1
e7db6ef37d39f25f11e151c1b6ea3a04e357ceed

SHA256
e1996e77be19119d7cd880c105e619aa6091d9c87dd74c52306907d97f71792a

SHA512
21a2dfa8852ea03c831e979ffce6cc80b512f7e60ad46b9c0333333f048a4cb747652f826b7a41d317d59e17699d5fd1ca95921f1bf3bf60d017712467202ca1

Download Submit
\Users\Admin\AppData\Local\Temp\is-N02GL.tmp\ProtonVPN.InstallActions.x86.dll

Filesize
567KB

MD5
6802d1ae0b114a8dc2827de0e6313f98

SHA1
5045354425d39ed7b7fb5e4153a86648bd14c4c8

SHA256
ff6ada11e1af2cf0516089a99b0b9ca01aa5b850e0b02c6ab6d5ae3b3e03531c

SHA512
d5d8870323239d8b5459d11a8d7036a001188a11472649006a4d57ee6b632b2b89be9a5c53f0429a6b42da8b4bfa2f14a10013c6fb2e79e802c90a0641f9a1ab

Download Submit
memory/2716-0-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/2716-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/2716-14-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/2716-22-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/2788-8-0x0000000000400000-0x000000000073D000-memory.dmp

Filesize
3.2MB

Download
memory/2788-16-0x0000000000400000-0x000000000073D000-memory.dmp

Filesize
3.2MB

Download
memory/2788-20-0x0000000000400000-0x000000000073D000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

Errors