4a5d86a0ecb495bd2b21ca768d089b5e39f5595172172881326fd0119f0be6ea

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp.exe
Size 6.4MB
Sample231220-2zvfashcc8
SHA256 4a5d86a0ecb495bd2b21ca768d089b5e39f5595172172881326fd0119f0be6ea
MD5 59e1852e8e8643b0433e3682dd254a66
SHA1 aff4a28d9ff8fa5991eb930923e83b6b27662e24
SHA512 4404914494468c05fe22e00158aeeaee54c254ae1a07dee1f48d973f6d677aa457453165c03c8472bdddce8ad9be8e10b9328d328ae12ab587815facc8cedbe3
SSDEEP 196608:VD4JIKyTpWO7JPEcw9BRPGSrOe3stZLRjQ01:VsJIKWpWO7lO9zPGne3wZVjQ01
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	XRJNZC.exe

Executes dropped EXE 3 IoCs

pid	Process
4728	XRJNZC.exe
2848	XRJNZC.exe
4460	XRJNZC.exe

VMProtect packed file 12 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1840-0-0x00000000008F0000-0x00000000014EB000-memory.dmp	vmprotect
behavioral2/memory/1840-5-0x00000000008F0000-0x00000000014EB000-memory.dmp	vmprotect
behavioral2/files/0x0007000000023222-14.dat	vmprotect
behavioral2/files/0x0007000000023222-15.dat	vmprotect
behavioral2/memory/4728-16-0x0000000000C80000-0x000000000187B000-memory.dmp	vmprotect
behavioral2/memory/4728-21-0x0000000000C80000-0x000000000187B000-memory.dmp	vmprotect
behavioral2/files/0x0007000000023222-23.dat	vmprotect
behavioral2/memory/2848-24-0x0000000000C80000-0x000000000187B000-memory.dmp	vmprotect
behavioral2/memory/2848-29-0x0000000000C80000-0x000000000187B000-memory.dmp	vmprotect
behavioral2/files/0x0007000000023222-31.dat	vmprotect
behavioral2/memory/4460-32-0x0000000000C80000-0x000000000187B000-memory.dmp	vmprotect
behavioral2/memory/4460-37-0x0000000000C80000-0x000000000187B000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3148	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
644	timeout.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 4492	1840	tmp.exe	92
PID 1840 wrote to memory of 4492	1840	tmp.exe	92
PID 1840 wrote to memory of 4492	1840	tmp.exe	92
PID 4492 wrote to memory of 644	4492	cmd.exe	94
PID 4492 wrote to memory of 644	4492	cmd.exe	94
PID 4492 wrote to memory of 644	4492	cmd.exe	94
PID 4492 wrote to memory of 4728	4492	cmd.exe	97
PID 4492 wrote to memory of 4728	4492	cmd.exe	97
PID 4492 wrote to memory of 4728	4492	cmd.exe	97
PID 4728 wrote to memory of 3148	4728	XRJNZC.exe	98
PID 4728 wrote to memory of 3148	4728	XRJNZC.exe	98
PID 4728 wrote to memory of 3148	4728	XRJNZC.exe	98

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s1f4.0.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:644
- - C:\ProgramData\pinterests\XRJNZC.exe
    "C:\ProgramData\pinterests\XRJNZC.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "XRJNZC" /tr C:\ProgramData\pinterests\XRJNZC.exe /f
      4⤵
      Creates scheduled task(s)
      PID:3148

C:\ProgramData\pinterests\XRJNZC.exe
C:\ProgramData\pinterests\XRJNZC.exe
1⤵
- Executes dropped EXE
PID:2848

C:\ProgramData\pinterests\XRJNZC.exe
C:\ProgramData\pinterests\XRJNZC.exe
1⤵
- Executes dropped EXE
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XRJNZC.exe

Path C:\ProgramData\pinterests\XRJNZC.exe
Size 3.4MB
SHA256 9bd7ce7f33358eda308c63ac8c5537343a9a670abe3ddbd6f56d2eff28c6adc8
MD5 60b1f1d265a4f195d06b7ab197035512
SHA1 275e56312bcc5218d2c125de85debe096d4d5379
SHA512 d3557046e59bcb44f6d271412202aedda7a653f1d22068fd30e33dd6736ae226e8a6beeecae1f1bf13cd64c7cbe9f4acc6e83fcf159c70c3ce7da2f64cccb40b
SSDEEP 98304:V3F0VhqR4JIKyTomnuzvBpOx6EGsJtVEcwfFBiBj:VD4JIKyTpWO7JPEcw9BO
MD5 SHA1 SHA512 SSDEEP

Submit Download

XRJNZC.exe

Path C:\ProgramData\pinterests\XRJNZC.exe
Size 3.8MB
SHA256 1733843be9bf996ac74bed5b474f2533dce21f9690bc8b6aec12d8dd57a970f3
MD5 b83b02240323d9c20ed9eaf5db19fffe
SHA1 89ce7b341c076a887ae3029ad562bc070727b058
SHA512 5b4c1d87ceebfa1abe6271a50e0a1a6c45de1056c9cd96c2942852c20bd1964dd5501a47f40f5f94d46328e3535180c9e8514c18b0e3069ee7d764f5036c2506
SSDEEP 98304:V3F0VhqR4JIKyTomnuzvBpOx6EGsJtVEcwfFBiBQPGrOrO:VD4JIKyTpWO7JPEcw9BRPGSrO
MD5 SHA1 SHA512 SSDEEP

Submit Download

XRJNZC.exe

Path C:\ProgramData\pinterests\XRJNZC.exe
Size 2.2MB
SHA256 47452f388ad19d58bbca116254e25ad8c0b26bc415fa01c2fa0f51491412fe2c
MD5 ccaa5d41b6a6986cacbfd01b704a711b
SHA1 81c2415b8297572bfff6287025c1e1c058402948
SHA512 f9f9944663038895a34dfdc3f5420b331adb8f9351f55fab1d38870262bec7db7851141a75533c9fbb5f3b09d2144d7ecaa78d380d8e8f63d0c5700ca723835e
SSDEEP 49152:jlT3vdS1VZh1qRi/6IgoPyq7ydVno4BGSuzvBgmZOdg:V3F0VhqR4JIKyTomnuzvBpO6
MD5 SHA1 SHA512 SSDEEP

Submit Download

XRJNZC.exe

Path C:\ProgramData\pinterests\XRJNZC.exe
Size 6.4MB
SHA256 4a5d86a0ecb495bd2b21ca768d089b5e39f5595172172881326fd0119f0be6ea
MD5 59e1852e8e8643b0433e3682dd254a66
SHA1 aff4a28d9ff8fa5991eb930923e83b6b27662e24
SHA512 4404914494468c05fe22e00158aeeaee54c254ae1a07dee1f48d973f6d677aa457453165c03c8472bdddce8ad9be8e10b9328d328ae12ab587815facc8cedbe3
SSDEEP 196608:VD4JIKyTpWO7JPEcw9BRPGSrOe3stZLRjQ01:VsJIKWpWO7lO9zPGne3wZVjQ01
MD5 SHA1 SHA512 SSDEEP

Submit Download

s1f4.0.bat

Path C:\Users\Admin\AppData\Local\Temp\s1f4.0.bat
Size 176B
SHA256 500fea348d0ed0fa5c5ac9404a54987e5a783f34e35550895219ef91d5102c58
MD5 22b251d8b2c88acce373122b8b3f9323
SHA1 806d656d22ea0240617762ecabede3ef5c08952e
SHA512 cfc262eceae34b9a6c440e9a56337f9649825910bbe1b34eb0908f459522757e35fb8a3665d55a8495c65c346c931cdff9dc04ab50352acdcc0a591a6725d9f5
MD5 SHA1 SHA512

Submit Download

memory/1840-5-0x00000000008F0000-0x00000000014EB000-memory.dmp

Download

memory/1840-0-0x00000000008F0000-0x00000000014EB000-memory.dmp

Download

memory/2848-29-0x0000000000C80000-0x000000000187B000-memory.dmp

Download

memory/2848-24-0x0000000000C80000-0x000000000187B000-memory.dmp

Download

memory/4460-32-0x0000000000C80000-0x000000000187B000-memory.dmp

Download

memory/4460-37-0x0000000000C80000-0x000000000187B000-memory.dmp

Download

memory/4728-21-0x0000000000C80000-0x000000000187B000-memory.dmp

Download

memory/4728-16-0x0000000000C80000-0x000000000187B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads