c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2024, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe
Size 78KB
Sample240414-br7sjscf63
SHA256 c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803
MD5 49562df8b8d20c60e1244daae9757855
SHA1 abce8212d9442f35a83e593d4c6c1306af444d5d
SHA512 5b375742326f75415477e5f7729d24073d46205323226739b32c0df8ed047e5b96a4ca5988a237c54175c6fafc763c50aaf34fe84691670d68d2a4af3cd9622e
SSDEEP 1536:R4V58Vdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC619/01F2:R4V58An7N041QqhgN9/l
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe

Executes dropped EXE 1 IoCs

pid	Process
3752	tmp48D0.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp48D0.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe
Token: SeDebugPrivilege	3752	tmp48D0.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1812	1932	c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe	83
PID 1932 wrote to memory of 1812	1932	c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe	83
PID 1932 wrote to memory of 1812	1932	c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe	83
PID 1812 wrote to memory of 4976	1812	vbc.exe	87
PID 1812 wrote to memory of 4976	1812	vbc.exe	87
PID 1812 wrote to memory of 4976	1812	vbc.exe	87
PID 1932 wrote to memory of 3752	1932	c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe	90
PID 1932 wrote to memory of 3752	1932	c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe	90
PID 1932 wrote to memory of 3752	1932	c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe	90

C:\Users\Admin\AppData\Local\Temp\c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe
"C:\Users\Admin\AppData\Local\Temp\c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-dudjfa9.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A96.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE9F845CEDEF4F538666A4A8B38663FD.TMP"
    3⤵
    PID:4976
- C:\Users\Admin\AppData\Local\Temp\tmp48D0.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp48D0.tmp.exe" C:\Users\Admin\AppData\Local\Temp\c6a54cfa45e32c729456b09dbb488ac300a97d64d24652bc1f85301e294fd803.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

-dudjfa9.0.vb

Path C:\Users\Admin\AppData\Local\Temp\-dudjfa9.0.vb
Size 14KB
SHA256 75f6b630b5e2a95a634f294d24071446116d851f7aefcae64faa5b56c5ba63e1
MD5 b6877bd1e7a32802c914fbbbc4d80914
SHA1 d8048482b248fbfa7d138db1ffd111a21daa509b
SHA512 dc6076fdb5ab2de35fcba7e8ed76255f217de1a936ae5f91671f0805e77bf9a5eb3d42936d51d7c6a98fe50f44f8821efc3841ff21f306a75d07d3afc308f9b9
SSDEEP 384:r9Nz6NOaNceNBVlnZNprNbcHb+E6NLzN7QZSN7eP:LKOGZ/lzpZbcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

-dudjfa9.cmdline

Path C:\Users\Admin\AppData\Local\Temp\-dudjfa9.cmdline
Size 266B
SHA256 dc96ecbac75c0faafbff2e5a6c403d4c858df73c6c8a8089e4ed83fd2d92d1bb
MD5 cea9ca26b01e20ec89b6821e18406116
SHA1 cd7a367262b082bffd93f67218f914c18f05b417
SHA512 fd4a2d770556044f5ef862e8440497fb79013ba95d2bdf93bafd57284b8c410d2982023f55a25e0bb9afaa681a65009b2e51727601136916e71158d885508a53
MD5 SHA1 SHA512

Submit Download

RES4A96.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4A96.tmp
Size 1KB
SHA256 cd225976e828af67b2788032d09c0848567651efb943dc3d1e0473faf8196569
MD5 40f5a708a4c54b833f663946a9f0e4d8
SHA1 c5eb7d4af4dbe52666dd60d431be239acc22de2a
SHA512 a894c538798b771118c580941cf5940c26a4ebe59595b1ca8b7df7334e51fe72f68227939f21ac071257f8e06d6eee084fcb3c14965315b70ca2ca607407b3a6
MD5 SHA1 SHA512

Submit Download

tmp48D0.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp48D0.tmp.exe
Size 78KB
SHA256 e6ab2f6b8bd1cc45e1516a234c71b974fcd627ec68d93c952e3e04f951a89847
MD5 a6cd626fc04b151030fa20b278df09c2
SHA1 01230e7bcc7752b0e8f0004dac41ae061c2bc906
SHA512 351ac925d48d2be918f404b4fa93ec714482cd8be031b31a6e32d64c8fdf9068bd13baddbc443c2e5eee1fcde98a6b110184aa67f551b4d6d9a0a2edd22b93e2
SSDEEP 1536:5CHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQteJJ9/m1J0:5CHY53Ln7N041QqhgeJJ9/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcE9F845CEDEF4F538666A4A8B38663FD.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcE9F845CEDEF4F538666A4A8B38663FD.TMP
Size 660B
SHA256 2878011fa9ba2d68d9754757da5e64cf6397bd93c60b9e4a9bce3d5531dbace2
MD5 4d9d3868ded1dea2d1da92eccdf73e77
SHA1 638491a649b1b4301a4fcd030ead82a93ac11a33
SHA512 dfe2a5387d05884cb10c2dfd0f58fdf67a9b5c4a03967d373070fb9ded5100a6d241570c6c3c9f7f69ac75fd12b741578a7a1942d509e39e7a8c7759943b3ac9
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1812-8-0x0000000002470000-0x0000000002480000-memory.dmp

Download

memory/1932-0-0x0000000075310000-0x00000000758C1000-memory.dmp

Download

memory/1932-2-0x0000000000A60000-0x0000000000A70000-memory.dmp

Download

memory/1932-1-0x0000000075310000-0x00000000758C1000-memory.dmp

Download

memory/1932-21-0x0000000075310000-0x00000000758C1000-memory.dmp

Download

memory/3752-22-0x0000000075310000-0x00000000758C1000-memory.dmp

Download

memory/3752-23-0x00000000010A0000-0x00000000010B0000-memory.dmp

Download

memory/3752-24-0x0000000075310000-0x00000000758C1000-memory.dmp

Download

memory/3752-26-0x00000000010A0000-0x00000000010B0000-memory.dmp

Download

memory/3752-27-0x0000000075310000-0x00000000758C1000-memory.dmp

Download

memory/3752-28-0x00000000010A0000-0x00000000010B0000-memory.dmp

Download

memory/3752-29-0x00000000010A0000-0x00000000010B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads