cbfc4f69200a5e7ee96ae849cc47a5a7606da8b38b911b2d4d741f067611692f

Analysis

max time kernel
120s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2023 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8905277162106_164921611252834_29¬.exe
Size

639KB
MD5

e9e9fa689c08fd23006cf14868576693
SHA1

b1ccdac67bf2f3ec1c22a332c052cdaa069990ad
SHA256

cbfc4f69200a5e7ee96ae849cc47a5a7606da8b38b911b2d4d741f067611692f
SHA512

e446bb491097487ed924084014bb19f757a36a4f946c310afac7e67c89d309c233bef20cbcebbdd501428c763708e1aea15af2a46ed9c5591d2181aed944aaa8
SSDEEP

12288:DwqjS4gdTB7L8GT8gNRQaISd7IG9yy4abbqiPT/Rk2m/+ynrr9dfeZ7zZp+ob/n7:DwqWJuabQHnrr9df27GO8

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	8905277162106_164921611252834_29¬.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bdcam.lnk	cscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2988	4020	8905277162106_164921611252834_29¬.exe	87
PID 4020 wrote to memory of 2988	4020	8905277162106_164921611252834_29¬.exe	87
PID 2988 wrote to memory of 4640	2988	cmd.exe	89
PID 2988 wrote to memory of 4640	2988	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\8905277162106_164921611252834_29¬.exe
"C:\Users\Admin\AppData\Local\Temp\8905277162106_164921611252834_29¬.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\yFLezBRy.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\system32\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp\gkop.vbs
    3⤵
    - Drops startup file
    PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gkop.vbs

Filesize
253B

MD5
bfa101a2d97b7a8d61b0f7923c8e2662

SHA1
e31805ea3742ae545cb447e02d950c8c1d37e465

SHA256
2651c4c6bf39c58bbba683c7b89ac9c2b15687c3163bb8aeb2d50a3096eec982

SHA512
53afb7ca9b3c36eea93afe9d22ecf736f78c20e526875ff8ab7878efff83b697f88e2899171b9847d9dbbf7c5333869dea951c9f573945b1634f9685234a5734

Download Submit
C:\Users\Admin\AppData\Local\Temp\yFLezBRy.bat

Filesize
554B

MD5
133ceb8ac85ec0144f193d4303dc80ae

SHA1
e8c68fff9bbd4336e7554b9565abc784b7abcee4

SHA256
017bddd004686f495fe4b1f2999a3a9d8106fa4b82de1a7be5248d3fa730c371

SHA512
ec27716c69ca1eaed05c13ab4c29bdba1030b1911fef6c30d0f43f2f0662beb4867b8c4af5748afe24694abbe7cfe16cff9727033a23bba3f9eebed00a987040

Download Submit