9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2024, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe
Size 78KB
Sample240414-aabs4sbf53
SHA256 9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801
MD5 b345c92088a0962999076a52890d0ade
SHA1 e0859fd26061fdf64382f167e405710ace64c7e3
SHA512 0ea6e3a63cd90d654d241e872f9ec01589f52f6988348dc52819d8fbc03b9dd15148aafff4dffc91438c10659bf2820a21b79d06681268b431ae105d87546e18
SSDEEP 1536:7sHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt59/H1CB:7sHY53Ln7N041Qqhg59/o
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe

Executes dropped EXE 1 IoCs

pid	Process
4772	tmp5AE1.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp5AE1.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe
Token: SeDebugPrivilege	4772	tmp5AE1.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2304	1732	9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe	84
PID 1732 wrote to memory of 2304	1732	9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe	84
PID 1732 wrote to memory of 2304	1732	9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe	84
PID 2304 wrote to memory of 1568	2304	vbc.exe	86
PID 2304 wrote to memory of 1568	2304	vbc.exe	86
PID 2304 wrote to memory of 1568	2304	vbc.exe	86
PID 1732 wrote to memory of 4772	1732	9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe	87
PID 1732 wrote to memory of 4772	1732	9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe	87
PID 1732 wrote to memory of 4772	1732	9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe	87

C:\Users\Admin\AppData\Local\Temp\9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe
"C:\Users\Admin\AppData\Local\Temp\9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m-kqgvd1.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CF5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE651FE1DB1244F19B529C2E3615EA0.TMP"
    3⤵
    PID:1568
- C:\Users\Admin\AppData\Local\Temp\tmp5AE1.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5AE1.tmp.exe" C:\Users\Admin\AppData\Local\Temp\9f66ffa87f04527ca1f4fe2bd67e0eff9b77bb3f5225dc49b10bf69b7e4f7801.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5CF5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5CF5.tmp
Size 1KB
SHA256 e813bf71de4d2b8327d84c963bb194c750c3181be5db106b8616fb871fb1cb89
MD5 70b596a6120ae21b9d61db15e4f10705
SHA1 31c98cd83ce392e200599b2b37f38797052d1879
SHA512 be5b246f88b0b657e2da2615c09111e8ea11089cad5784b4e13ddfe758fec7561e58face403ba58d5a0d62b1ff57b166feb7de57c1ca247e7a7efd3cfdfd19e4
MD5 SHA1 SHA512

Submit Download

m-kqgvd1.0.vb

Path C:\Users\Admin\AppData\Local\Temp\m-kqgvd1.0.vb
Size 15KB
SHA256 dcce10db3126eca6112493a51307550aec0894d9d200d46a5cc01b1a20b837fa
MD5 980f523757af406ddd923bc5c8d8cb2e
SHA1 6f5f022864c3c8f0ae39fc433975611aa087a176
SHA512 de46426eb8eee75233c154ff88af82089269a28a3640928b8c8f66ef3c190c458d5e6785d7bebd91eb21ccd9227d12092fc0c862e8595990362852f248d93244
SSDEEP 384:rONpNB+5NcXQNVALhhIXyNTNlJcHb44E6NqzN7QsSN7eP:ejB+TcXYVKhhIOBlJcH8sqhV+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

m-kqgvd1.cmdline

Path C:\Users\Admin\AppData\Local\Temp\m-kqgvd1.cmdline
Size 266B
SHA256 0ee8fb32cfb1de214f6ad0167292570153dcd633283e470ce8dfb416566a6c72
MD5 57660a1edc78df23708ebeb1831a344f
SHA1 282ba409de65c596e5524748f90ad8bedfed4ce6
SHA512 1da638d9367e7a0e963d0460ea16186a815e0276cd7ba341a8024b7568b055af81780a6a273edd1e92845883af52dc392d24d2659606484eab75a753e790475b
MD5 SHA1 SHA512

Submit Download

tmp5AE1.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5AE1.tmp.exe
Size 78KB
SHA256 f52209472a3890d27acdcdbfc0ea29ffdedd039e036f27c4b6042b75cdfea5f7
MD5 303e4254e38c3ca72addf2852c7b730c
SHA1 e7eb0e4e7011f3fef841bd039772902f64cb7f61
SHA512 e2cb2d93e262c564102835847cdba8d5ac0e55032e35d369d4ebef15f2157ec93ea7d6286cf7592209311af6363bbb63f8bc751308fd971d28aea554cce8eae2
SSDEEP 1536:cV586dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6IZX9/W1Et:cV581n7N041QqhggZX9/T
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcE651FE1DB1244F19B529C2E3615EA0.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcE651FE1DB1244F19B529C2E3615EA0.TMP
Size 660B
SHA256 614fec91d1c3d8747c859e578838cb44d200df93d9f21f558679a9fc93fddac0
MD5 b7c55213c407b4a84a9d92f3d09af821
SHA1 443c79f9a1b220905603da68d264a8fa45387c7c
SHA512 0e453a6a82b7565fc7e7ead1185d524b65b94d06655c0dfc49843d8a791a196a938781514f66278740561955786207e4b3e13b47cf32934da4c1e46b6eacc357
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1732-21-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/1732-1-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/1732-2-0x0000000000E40000-0x0000000000E50000-memory.dmp

Download

memory/1732-0-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/2304-8-0x00000000006A0000-0x00000000006B0000-memory.dmp

Download

memory/4772-22-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/4772-23-0x0000000001470000-0x0000000001480000-memory.dmp

Download

memory/4772-24-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/4772-26-0x0000000001470000-0x0000000001480000-memory.dmp

Download

memory/4772-27-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/4772-28-0x0000000001470000-0x0000000001480000-memory.dmp

Download

memory/4772-29-0x0000000001470000-0x0000000001480000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads