53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe
Size

196KB
MD5

d43ae4ce9cdb22793d56ad7798a8eb66
SHA1

df5dd918c7f9b352ab2cc1a75e216f6f0bdba7da
SHA256

53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96
SHA512

636fe71b8f4146e8c545cc8ffe02aeec8d0047fb862be184e83654615823e4e11f572fbecf167b4d7b24531a7565879f7ba399dd1cdf0b2900782ac7d04d003a
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO3:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXq

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe

Executes dropped EXE 1 IoCs

pid	Process
384	vgkhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\vgkhost.exe	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe
File opened for modification	C:\Windows\Debug\vgkhost.exe	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vgkhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vgkhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2748	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 1168	2748	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe	89
PID 2748 wrote to memory of 1168	2748	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe	89
PID 2748 wrote to memory of 1168	2748	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe	89

C:\Users\Admin\AppData\Local\Temp\53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe
"C:\Users\Admin\AppData\Local\Temp\53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\53CE81~1.EXE > nul
  2⤵
  PID:1168

C:\Windows\Debug\vgkhost.exe
C:\Windows\Debug\vgkhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\vgkhost.exe

Filesize
196KB

MD5
dd3001cfc0969afc298697c241063746

SHA1
ef57e1a7e35a937762c9df68cbf475cef24a2999

SHA256
33fcb93ff7fedd557640ae1fbb83012706ebda9a120fb389871d228f6d3a8fe6

SHA512
77506e1f6c4389de4f6bad0960635206d677696461ada60a93efe0b57b5822d18dc24822f8d5fb24fa2fba396849321dade9339c45d09999c3648af624631c94

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads