404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc.exe
Size

198KB
MD5

c600a7494c549078e17967070df7500d
SHA1

30e1aa8a50c613b241db1fec0c8fed934be66ef1
SHA256

404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc
SHA512

dcda56833187b7b18550f07d3e9b00f38e3c9ff1b1ce49d1ddcbf523665f43181a57ec9942a11083b3ac4163e340f5a6605f2dde5e7464bae8552b4c1b5f5591
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOk:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXX1

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc.exe

Executes dropped EXE 1 IoCs

pid	Process
4716	vgkhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\vgkhost.exe	404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc.exe
File opened for modification	C:\Windows\Debug\vgkhost.exe	404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vgkhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vgkhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4712	404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 456	4712	404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc.exe	93
PID 4712 wrote to memory of 456	4712	404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc.exe	93
PID 4712 wrote to memory of 456	4712	404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc.exe	93

C:\Users\Admin\AppData\Local\Temp\404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc.exe
"C:\Users\Admin\AppData\Local\Temp\404271ef3979420156f87ba1984c95e4a6bc28327cff7a21be0db200319517cc.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\404271~1.EXE > nul
  2⤵
  PID:456

C:\Windows\Debug\vgkhost.exe
C:\Windows\Debug\vgkhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\vgkhost.exe

Filesize
198KB

MD5
fba8d0122dcc9fae4820b2423932db7f

SHA1
34caa9041d7c1185d5112bc2a1e02215762a680d

SHA256
a662f9db0df6cc524618c8ac378fc238fee3526a5b2d356da76ce1ea31ca4e9e

SHA512
4f0440cf401eed9bff4bb3a0a1255676a4381d5e9c9786c3bbd0d6d51435f3dd8446c88ceb9b4acf7743f4fd63333a2c839f66e17a9ae73647ee139fa3605d05

Download Submit
C:\Windows\debug\vgkhost.exe

Filesize
198KB

MD5
fba8d0122dcc9fae4820b2423932db7f

SHA1
34caa9041d7c1185d5112bc2a1e02215762a680d

SHA256
a662f9db0df6cc524618c8ac378fc238fee3526a5b2d356da76ce1ea31ca4e9e

SHA512
4f0440cf401eed9bff4bb3a0a1255676a4381d5e9c9786c3bbd0d6d51435f3dd8446c88ceb9b4acf7743f4fd63333a2c839f66e17a9ae73647ee139fa3605d05

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads