Analysis

  • max time kernel
    142s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 18:30

General

  • Target

    06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe

  • Size

    12KB

  • MD5

    21cb7e841d8dff22cbd87812e681667f

  • SHA1

    6b201959421af1b4356763e5fcae1cd8e177b173

  • SHA256

    06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec

  • SHA512

    9200471ba6341ddbba67243fd2064bea0767cc30d5003794f287e531280be0a94f30a107c847bbf56e52328b5180efb1052504efcf0f1c1eeb99cb1ee11c084e

  • SSDEEP

    384:CL7li/2zvq2DcEQvdhcJKLTp/NK9xaQx:cbM/Q9cQx

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe
    "C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l2lrccfh\l2lrccfh.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8855.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc95BA6CA08DD34040B28C7974DF04288.TMP"
        3⤵
          PID:3288
      • C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe" C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe
        2⤵
        • Deletes itself
        • Executes dropped EXE
        PID:3228
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5240 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:2900

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\RE.resources

              Filesize

              2KB

              MD5

              52627d163bf47398918c344c0f486765

              SHA1

              5c6d1e4884aa1c65e3b2f8c52efab110ebd22040

              SHA256

              67360b0661c53bb2dabe317ece26d065ea34266543e1b2f105b632f85cfcd5bd

              SHA512

              488b86a1d59b514ee4adabeadac26f925405bebb97101c5f78bf1dfaf3f6b6534f4f54fb8636b6e6a2ef69f22436b601e11b6f40893127f2780a3ca0c1503d9e

            • C:\Users\Admin\AppData\Local\Temp\RES8855.tmp

              Filesize

              1KB

              MD5

              5f0c0ff14fd49a8ac6d0b9e08470ab38

              SHA1

              8488f70d4bcd449d4017cec928b0c75830195747

              SHA256

              88b5292e614fa5ae6d7df34722fa3e301df4c9448625059a4077d8f3c548bdcb

              SHA512

              d4f0331d87d069a24c9316d0f8a5fbcb2b12bead647d097ecb58a47d4078199f7bb1e5a9f464bd4ffe2a48dc967f8a6069c1f2a91a8714c06ef9f6b2f8ac2c2a

            • C:\Users\Admin\AppData\Local\Temp\l2lrccfh\l2lrccfh.0.vb

              Filesize

              2KB

              MD5

              d1d41b41635c27a39a4ce224a34576e6

              SHA1

              72efdad2ccea7f3c1ab98a59d4f9fffa68dead8e

              SHA256

              718d73da66e72c512ad900bb30a4b3544bf462ee8a14ac10191040e2d134cb9a

              SHA512

              f0aaa9156394ac3fef2b569299cf4db522327c647dc90728ad95dbf4b2fa878f545b1ea951a69f883698cf87c854fa3fd764fd002405b7e11da82db6af04baf6

            • C:\Users\Admin\AppData\Local\Temp\l2lrccfh\l2lrccfh.cmdline

              Filesize

              273B

              MD5

              fbf6b0510770834eaa24a1797f7be207

              SHA1

              d2650c4ae592e2d3d2f88dae9711cdec73666de8

              SHA256

              e7051ec5e95518bf4c92f237a9d09904b2344a3cf8e02f2d7aa66c28b9743b0f

              SHA512

              c42f9d728f6651657946a9c174a4d6b1b770e08e3e0a1cca8a7c6fdc723d334bdf7d794b291b57f61abdd270ec0e6658cea6bc11c22e8ed7d8cccf45f5352245

            • C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe

              Filesize

              12KB

              MD5

              a3bccb9b16e908af8435d2daa048c8ff

              SHA1

              d4fbef098d5cea233713903b0174d80e90385a0e

              SHA256

              3e0cef46b60b72b49c7e44ff7f84007e786f53b0be84611b9cb0cea0bd61e78d

              SHA512

              184a50c471d6dfde5ea8061f76927d16236df7b16586bacf4f3e4ec3fcb52a896a125fbcf72aa2d9bd748e89baabdbe8a007419cc6f2cb1ec7a9544486dc0e6c

            • C:\Users\Admin\AppData\Local\Temp\vbc95BA6CA08DD34040B28C7974DF04288.TMP

              Filesize

              1KB

              MD5

              cda0ad7d391345e13af12857fb3aafe4

              SHA1

              5d03b181c1f8f08a3ab309b395628cfb68a3b673

              SHA256

              f157cfb51bbffc2cf0b8a7ca222303afb20fe9a150230ba94fcc6495fb964545

              SHA512

              c0d931df1407442750e073a22c4624cc28652e2a452858db6e63c091e7cd4feb47dd701203c2a2e2d56235ebc6ab343641cb3731fb4d302b442356d456a1c26b

            • memory/956-22-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

              Filesize

              4KB

            • memory/956-2-0x0000000004A90000-0x0000000004B2C000-memory.dmp

              Filesize

              624KB

            • memory/956-1-0x0000000000050000-0x000000000005A000-memory.dmp

              Filesize

              40KB

            • memory/956-7-0x0000000074EE0000-0x0000000075690000-memory.dmp

              Filesize

              7.7MB

            • memory/956-0-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

              Filesize

              4KB

            • memory/956-27-0x0000000074EE0000-0x0000000075690000-memory.dmp

              Filesize

              7.7MB

            • memory/3228-25-0x0000000000C40000-0x0000000000C4A000-memory.dmp

              Filesize

              40KB

            • memory/3228-26-0x0000000074EE0000-0x0000000075690000-memory.dmp

              Filesize

              7.7MB

            • memory/3228-28-0x0000000005B00000-0x00000000060A4000-memory.dmp

              Filesize

              5.6MB

            • memory/3228-29-0x00000000055F0000-0x0000000005682000-memory.dmp

              Filesize

              584KB

            • memory/3228-31-0x0000000074EE0000-0x0000000075690000-memory.dmp

              Filesize

              7.7MB