c06f4e5289cde6fd5fd854a09c4d9688ccfbc9b10228ffc5744e1b514ef8ea69

Analysis

max time kernel
152s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c06f4e5289cde6fd5fd854a09c4d9688ccfbc9b10228ffc5744e1b514ef8ea69.exe
Size

63KB
MD5

08388dae31961f3b39cf876837571858
SHA1

476b940dec0bb73da2b44839b40110d468d35261
SHA256

c06f4e5289cde6fd5fd854a09c4d9688ccfbc9b10228ffc5744e1b514ef8ea69
SHA512

4d8e4dc7d9c8eebc79550c22f10f4eb69026cf37cb1e2e3b6f5809bf4bf0e89fb15c3d748ec97bc40a3446cc6752423250e33fb4a370da738204cd8d13932950
SSDEEP

768:TO0EWgIos/JdQm2iE8NUIu0oWsV1qaZIp/Bj7YcRpaSOovHYxtxdve:SLe92iEzGs1stvHYxtHG

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4716	vcfuam.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	c06f4e5289cde6fd5fd854a09c4d9688ccfbc9b10228ffc5744e1b514ef8ea69.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	vcfuam.exe
4716	vcfuam.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
844	c06f4e5289cde6fd5fd854a09c4d9688ccfbc9b10228ffc5744e1b514ef8ea69.exe
4716	vcfuam.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 4716	844	c06f4e5289cde6fd5fd854a09c4d9688ccfbc9b10228ffc5744e1b514ef8ea69.exe	87
PID 844 wrote to memory of 4716	844	c06f4e5289cde6fd5fd854a09c4d9688ccfbc9b10228ffc5744e1b514ef8ea69.exe	87
PID 844 wrote to memory of 4716	844	c06f4e5289cde6fd5fd854a09c4d9688ccfbc9b10228ffc5744e1b514ef8ea69.exe	87

C:\Users\Admin\AppData\Local\Temp\c06f4e5289cde6fd5fd854a09c4d9688ccfbc9b10228ffc5744e1b514ef8ea69.exe
"C:\Users\Admin\AppData\Local\Temp\c06f4e5289cde6fd5fd854a09c4d9688ccfbc9b10228ffc5744e1b514ef8ea69.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\vcfuam.exe
  "C:\Users\Admin\vcfuam.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\vcfuam.exe

Filesize
63KB

MD5
008f3f80fa541184aafdeaf47a1e6ca6

SHA1
ef25c8cfefa9e85348c895cf6bccecfac80a99c8

SHA256
66c4b31f623869ca94f29cb0d3e779dd58cae721a1254f9b25d4506215235704

SHA512
b6fe6971879c0e31d1bc7b6687ae47ebc0a49bae987c31194840113b1aad5de059e1b3ebcb1c9273b53aa71f0d07d73d6b03b2722023669b6df32ba6a59d9716

Download Submit
C:\Users\Admin\vcfuam.exe

Filesize
63KB

MD5
008f3f80fa541184aafdeaf47a1e6ca6

SHA1
ef25c8cfefa9e85348c895cf6bccecfac80a99c8

SHA256
66c4b31f623869ca94f29cb0d3e779dd58cae721a1254f9b25d4506215235704

SHA512
b6fe6971879c0e31d1bc7b6687ae47ebc0a49bae987c31194840113b1aad5de059e1b3ebcb1c9273b53aa71f0d07d73d6b03b2722023669b6df32ba6a59d9716

Download Submit