29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe
Size

88KB
MD5

0718af0923bc5061c9ec5200b402a617
SHA1

3ed8d34e9d64dbf50d59d1536691c47ff5b2eb7d
SHA256

29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e
SHA512

a65c20fa2b72a0d3daa86aa838b66ff2c8e55532d6545c9a645569998a1e6ef4137689d8ee5e02e0bc0d5998d7c9f81d259623a76cea1e20aedfe531b84cd2b6
SSDEEP

1536:dXNXdlRH+Dwk4cSGesvhC8plnQ85+HwClgfTQqPTFTCtOQ8Ccfix:ddtlRH+UxGzh3HQ85+QqoTBfix

Score

7^/10

bootkit discovery persistence vmprotect

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2172	svchosts.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2344-0-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect
behavioral1/memory/2344-1-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect
behavioral1/files/0x000c00000001225c-8.dat	vmprotect
behavioral1/memory/2172-12-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect
behavioral1/memory/2344-20-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect
behavioral1/memory/2172-416-0x0000000000400000-0x0000000000431000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\windows\svchosts.exe	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe
File created	C:\windows\svchosts.exe	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D51CB5B1-0BEB-11F0-8121-F6D98E36DBEF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449338674"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f3b1534d7b559642962883233d7bce09000000000200000000001066000000010000200000007338709d8afefff1f7ebb8a3db28f7f2f4efbdaf68e4035071ff5bff015f6abd000000000e8000000002000020000000afb5aa92c003e07e3d3eaf5c1a63d4135f3a43158faae1373b55a915a8c6602e2000000075620b933b0defe17cc00435df77c25a5aaaefec6a2be9688f5452c1342e936c4000000091564b93371baa38f5f479b3b908b445c025d5538389649c867dfb8dff744ef238c436975c852ada86bb3b20691ef9b4dcabcbcf6952d4ac220007231ecd3f57	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a07f06aaf89fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f3b1534d7b559642962883233d7bce0900000000020000000000106600000001000020000000792dcbe6dba3353ae89cefda333ed9b747dad1ffdc1011077191e008b0b3d957000000000e80000000020000200000000ba1c8f6edf77ffc1e6e8c8af55ce4fab72bb35e9b50b5a11e10579facec136e9000000025b2a1f41b527056d9853c60ee4bd44a19bff5734742f04967908d233b599ce3414c64ecddb91d7a9a4bd5c53cffc7a065cfe4548c3a3829a401376d605b604d796fc7da8cdb81e58a39bf1512abbedd5040f2989a7e4a921105612ba67ac16332a78004d861864512d132907736f7e41ecd1f75a0f84790107edb08f101cdb437394f8956bcf354a02505c5b194a4f540000000d709678d47fa3197641f4d6c66a1722b9f54fb53a09cd1f82309bcd3ce813c42d810d4a48d1983a5c1aa4918ea97b64410c8ed2cd8bb14f37d31e7e1bc721122	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2344	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1216	iexplore.exe
2172	svchosts.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2344	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe
2172	svchosts.exe
1216	iexplore.exe
1216	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2172	2344	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe	29
PID 2344 wrote to memory of 2172	2344	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe	29
PID 2344 wrote to memory of 2172	2344	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe	29
PID 2344 wrote to memory of 2172	2344	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe	29
PID 2344 wrote to memory of 1216	2344	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe	30
PID 2344 wrote to memory of 1216	2344	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe	30
PID 2344 wrote to memory of 1216	2344	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe	30
PID 2344 wrote to memory of 1216	2344	29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe	30
PID 1216 wrote to memory of 2520	1216	iexplore.exe	31
PID 1216 wrote to memory of 2520	1216	iexplore.exe	31
PID 1216 wrote to memory of 2520	1216	iexplore.exe	31
PID 1216 wrote to memory of 2520	1216	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe
"C:\Users\Admin\AppData\Local\Temp\29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\windows\svchosts.exe
  C:\windows\svchosts.exe auto
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2172
- C:\progra~1\Intern~1\iexplore.exe
  C:\\progra~1\\Intern~1\\iexplore.exe http://jianqiangzhe1.com/AddSetup.asp?id=137&localID=232138804165&isqq=3
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1216 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2f2985c22a04673cc6cf81e08ce119c

SHA1
ceeef4a1aab853daa5b6936dc71057cd654b8808

SHA256
6071562ad009d7a173c335e552f8ba7066d1eb496de09533a34eaa557bbc941d

SHA512
cc394a4f18167fe9fe042fb4d2dad18d9b4083ef646951b2b4b196a1c1903c27c9a939dad779d15dbd3261b53f4ed66856939925275eb3b2aabcdd7e932fe2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c638317ea89edd28f28cbaeee1669ff

SHA1
96691d467032cea7ec0f2a1a2a689be0ee342c45

SHA256
c960a9d07f402d0f2f5047e6db610a0180a1c55d87eac9919304e4ff909a70ea

SHA512
c87422357b628e2f57ee30cad35f8640799347d8ca9770635e39f22db06f36a163656aa724dbca10fd429aaefebba2179887562bb4467fa67408fdc91c021699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a0944d84b5c818f8136e2b0a0f8e7be

SHA1
090631c85ddc687d348ff9de7f61143748d67944

SHA256
3d76b309597939126bfd4f2db5c388ab37d7f88b212e76bd295e0dde59e5fb84

SHA512
55af6561fa0945b0a27e33ce78901d8dc99bc37aefa6fa5a1d954e8867da4aefa8426da4ffa033e72e5df345ca69267cfceabc84daf7e6837c4d49ead0a1385f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf0c80be0cfaa431487611786e735f62

SHA1
07319ad7d8eb80e2b62bff8bf5077b1f928c22a2

SHA256
7dda6a61974106a7027128c8132c5231837e1970fc4bf5957d2d1c22dec5d7be

SHA512
50e43aa08741fd8cdb9ef315b2da97d4b60c4948beccdd6ab1b2bd1bada892d454e2fc25d291b7e0d0f61921323875c643738b3e628d8ee42b5306c8660435aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F67.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9113.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Windows\svchosts.exe

Filesize
88KB

MD5
0718af0923bc5061c9ec5200b402a617

SHA1
3ed8d34e9d64dbf50d59d1536691c47ff5b2eb7d

SHA256
29093e8a65e245f8e1dcddb7e05cdf79ee6ab317d76bdbff94103b451deac21e

SHA512
a65c20fa2b72a0d3daa86aa838b66ff2c8e55532d6545c9a645569998a1e6ef4137689d8ee5e02e0bc0d5998d7c9f81d259623a76cea1e20aedfe531b84cd2b6

Download Submit
memory/1216-15-0x0000000002660000-0x0000000002670000-memory.dmp

Filesize
64KB

Download
memory/2172-21-0x00000000004B0000-0x00000000004B2000-memory.dmp

Filesize
8KB

Download
memory/2172-12-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2172-416-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2344-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2344-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2344-11-0x00000000002F0000-0x0000000000321000-memory.dmp

Filesize
196KB

Download
memory/2344-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download