Analysis
- max time kernel
148s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2023, 14:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Pls. Review Attached.exe
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pls. Review Attached.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target Pls. Review Attached.exe
- Size 1.2MB
- Sample230530-rlq6lsad2v
- SHA256 283701722fd569d223d0118a3e85b3e63fa97af7a66dd452d9da0346cefd40bf
- MD5 1a5cda84c98bb1cacff0d931ca896a81
- SHA1 a0625fd91fe241eb49b1e25c87edf6f5fa5c793e
- SHA512 35733db9c45f29d3a25ab9a675a5c5c458142d194016c3070a6069871c759597dca787edb1cfbaa377b122babdd316bff70f013bd77a5ad7354af7e8c74cf90c
- SSDEEP 24576:vTbBv5rUPL6byutZfb8Zqlc3fwStW7syeVKN/5ivrWvU:ZBwW1ZIUStWgy0KN/5ivriU
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation Pls. Review Attached.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation wscript.exe - Executes dropped EXE 1 IoCs
pid Process 3064 kgsifum.msc - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3064 set thread context of 1468 3064 kgsifum.msc 98 PID 3064 set thread context of 3124 3064 kgsifum.msc 97 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4704 ipconfig.exe 1096 ipconfig.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3064 kgsifum.msc 3064 kgsifum.msc 3064 kgsifum.msc 3064 kgsifum.msc 3064 kgsifum.msc 3064 kgsifum.msc 3064 kgsifum.msc 3064 kgsifum.msc 3064 kgsifum.msc 3064 kgsifum.msc 3064 kgsifum.msc 3064 kgsifum.msc 1468 RegSvcs.exe 1468 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 3124 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe 1468 RegSvcs.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3124 RegSvcs.exe Token: SeDebugPrivilege 1468 RegSvcs.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4552 wrote to memory of 4416 4552 Pls. Review Attached.exe 83 PID 4552 wrote to memory of 4416 4552 Pls. Review Attached.exe 83 PID 4552 wrote to memory of 4416 4552 Pls. Review Attached.exe 83 PID 4416 wrote to memory of 4508 4416 wscript.exe 84 PID 4416 wrote to memory of 4508 4416 wscript.exe 84 PID 4416 wrote to memory of 4508 4416 wscript.exe 84 PID 4416 wrote to memory of 2384 4416 wscript.exe 86 PID 4416 wrote to memory of 2384 4416 wscript.exe 86 PID 4416 wrote to memory of 2384 4416 wscript.exe 86 PID 4508 wrote to memory of 4704 4508 cmd.exe 88 PID 4508 wrote to memory of 4704 4508 cmd.exe 88 PID 4508 wrote to memory of 4704 4508 cmd.exe 88 PID 2384 wrote to memory of 3064 2384 cmd.exe 89 PID 2384 wrote to memory of 3064 2384 cmd.exe 89 PID 2384 wrote to memory of 3064 2384 cmd.exe 89 PID 4416 wrote to memory of 4532 4416 wscript.exe 92 PID 4416 wrote to memory of 4532 4416 wscript.exe 92 PID 4416 wrote to memory of 4532 4416 wscript.exe 92 PID 4532 wrote to memory of 1096 4532 cmd.exe 94 PID 4532 wrote to memory of 1096 4532 cmd.exe 94 PID 4532 wrote to memory of 1096 4532 cmd.exe 94 PID 3064 wrote to memory of 3124 3064 kgsifum.msc 97 PID 3064 wrote to memory of 3124 3064 kgsifum.msc 97 PID 3064 wrote to memory of 3124 3064 kgsifum.msc 97 PID 3064 wrote to memory of 1468 3064 kgsifum.msc 98 PID 3064 wrote to memory of 1468 3064 kgsifum.msc 98 PID 3064 wrote to memory of 1468 3064 kgsifum.msc 98 PID 3064 wrote to memory of 1468 3064 kgsifum.msc 98 PID 3064 wrote to memory of 1468 3064 kgsifum.msc 98 PID 3064 wrote to memory of 1468 3064 kgsifum.msc 98 PID 3064 wrote to memory of 3124 3064 kgsifum.msc 97 PID 3064 wrote to memory of 3124 3064 kgsifum.msc 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pls. Review Attached.exe"C:\Users\Admin\AppData\Local\Temp\Pls. Review Attached.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" dmd.vbe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release3⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /release4⤵
- Gathers network information
PID:4704
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c kgsifum.msc kmqpi.txt3⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\kgsifum.msckgsifum.msc kmqpi.txt4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew3⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew4⤵
- Gathers network information
PID:1096
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\dmd.vbe
- Size 49KB
- SHA256 ba55df58c2ac0c82788690bc9b68180d2c87e2a72a1d6f5fe076f33b2aa3b71f
- MD5 d03cf628e33a6f01a0d62fa48c526ae8
- SHA1 ae81036540e11b2be504662bfb61ee06cee56032
- SHA512 877d37a23269c8f747f5c1c7af15c9cb17b3e023447101aff676a7d3ab4996bdf929719ac62f91ef2b9b2d96cefddee1d8bd0cd7869bbd2f73e750f62adaa6d9
- SSDEEP 1536:6+02StLS+02StLh+02StLf+02StLYz+02StLa+02StLV+02StLY1+02StL9:ELcLhLjLYnLkLVLY1L9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\dvtoxd.eht
- Size 364KB
- SHA256 2c8400d742a5f737ffb2ff600b7a70318eb90708caa94b45de2a5e62c9404284
- MD5 e713483becb9dac6b2c754ea185d2e34
- SHA1 7bddc22d3844cceb97fab8c234facdeeeea0a454
- SHA512 f855bdc53f15047df996727e88a3d39d457c706340b82cbd7c1e46fe25bd36922d5fe2c1d4fe8d07f25f8ddcd6e5580010b0142d43b70c30044ae0cd5a7c1e9b
- SSDEEP 6144:RvzbWdnICaGH8uSOCHnbQPEy/0OitE7gW7Rm9Z:NW1UcbCHbqitE791Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\gvgqqgq.jpg
- Size 40KB
- SHA256 814b29b6c5ac3c49b625604022937c34ee3e13ce995531ac0cd555f8b35e64da
- MD5 f152574003eee6c86edf10d803cea0be
- SHA1 38b93f1f72b983b5203cb8496ab8b0065d444cfa
- SHA512 6757d7f83ca55ebb89f00c085db935ab8c518147f1cc33e955924bf84965060d3e04bf85c9bcbf1747e3d3b5e16df94835bedbd1bd60e4de58e291d87a0b3ba2
- SSDEEP 768:detk0VUR7vwkUnZKIJXheA45buvEKlhdm5Z198STGLoTUXHnoVyTcl:dyHpkUnwSXAXmlhdmr199Ts0J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kgsifum.msc
- Size 1.1MB
- SHA256 3f512be4fe8f664e65d81bd3e89abf4b83d6cbae17fd67bef4c3bb1606e88555
- MD5 613a13aaacd3485e997da722569cdad2
- SHA1 71f5bdfa9c48e42d88e2eedc73c2003bf0534455
- SHA512 a7847f4a8de731736b0cc30fea9d80009d3a2f2395741fa3ae9ee8593030af59a6131e908b4a6da0f543efeea81a3d3bcbad0ca83383b196133782a644e87eba
- SSDEEP 24576:AYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaswpeJTzwpeJqel:A37+KSbq5e1diEnHarpe9speJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kmqpi.txt
- Size 106.3MB
- SHA256 f4f4aa4e7b13c1472852978aebe936c5673ded315ac83088c3d9320b61ca94b5
- MD5 a7f382b2ad6f40afcfce3b0ec5ec37fc
- SHA1 68b7e6b4b43b076603e34dae051b23e1222bd6b5
- SHA512 9cfbb68c96b5bb3695c9faaa05ab2fcf7d0be209ad616e0aab3789ada0181286cfd5df99ab0d945d1d29b0ce5fbb412be9a32fb752d638253342fa2333eb779e
- SSDEEP 196608:KHmCcI/Ct3ioKRjvOoF8sNBzPmX4RXbj0ikHLHS7a81drFIRvlUptamrYNi+I+CN:c
- MD5 SHA1 SHA512 SSDEEP