63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe
Size 12KB
Sample240528-11aa3sfe28
SHA256 63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068
MD5 7842f4c435bb4f5a7e2e0fd23b0b11cc
SHA1 45d448501c0d8edda494044de9963b273b9b6544
SHA512 d5f9cf7df203b9eea108c6d1fa45f96b5ba9299fb1d9780aa1a5e24abe0404ed19a755e2a74cd8cc03510c17cdd91707b742fd26a070712945b5097404053d52
SSDEEP 384:UL7li/2zPq2DcEQvdQcJKLTp/NK9xaAX:C7MCQ9cAX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe

Deletes itself 1 IoCs

pid	Process
2064	tmp5A94.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2064	tmp5A94.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1544	4368	63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe	85
PID 4368 wrote to memory of 1544	4368	63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe	85
PID 4368 wrote to memory of 1544	4368	63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe	85
PID 1544 wrote to memory of 4228	1544	vbc.exe	87
PID 1544 wrote to memory of 4228	1544	vbc.exe	87
PID 1544 wrote to memory of 4228	1544	vbc.exe	87
PID 4368 wrote to memory of 2064	4368	63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe	90
PID 4368 wrote to memory of 2064	4368	63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe	90
PID 4368 wrote to memory of 2064	4368	63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe	90

C:\Users\Admin\AppData\Local\Temp\63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe
"C:\Users\Admin\AppData\Local\Temp\63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0pafk4us\0pafk4us.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CF5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2AA5C5C6DA36483D9B9DF3B926C9CFA.TMP"
    3⤵
    PID:4228
- C:\Users\Admin\AppData\Local\Temp\tmp5A94.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5A94.tmp.exe" C:\Users\Admin\AppData\Local\Temp\63e0fab83bb85d050735166356140a92fdc336f765fce3eb062e064211b1c068.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0pafk4us.0.vb

Path C:\Users\Admin\AppData\Local\Temp\0pafk4us\0pafk4us.0.vb
Size 2KB
SHA256 993ecd32dc9ae43011ed16fe6c066aca6460934f4941e176ac7abebefc4de5e8
MD5 e9e452dac05288a03b4d825bd8358b3b
SHA1 fb02036de7051bb8991541eac6a8a9534f13992a
SHA512 7da9684bfc40da5b367be86fc2de1433b3a3206f6348961686f3d465c67efacc20271a66ae8f3d99909ffedb46623f58b1ac89b65c27d56c4bc97212dac355cb
MD5 SHA1 SHA512

Submit Download

0pafk4us.cmdline

Path C:\Users\Admin\AppData\Local\Temp\0pafk4us\0pafk4us.cmdline
Size 273B
SHA256 4f6ebdda48dbd5e2d9ce0a77491a29a357ca9813e69fbdfa8121b409a2b5be46
MD5 73bf6cef48d2973aae4e5d5ac770f59c
SHA1 3fdde722697d2f42339596f78a6a2df969c1cb77
SHA512 1bc7f6abbd95b6cc0a39c819f1dd31b800270d392ec505233f179b285286b75c653220cc5e7aa1921339445c30a9d29f07534a9accc17325ddcec1105ffea8f7
MD5 SHA1 SHA512

Submit Download

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 ece7d7b7aabcfce7b353df45a792d8660c973c36e32b9337b4baecc4ced33784
MD5 cb9fb49395f8f4153d804005077dc8c5
SHA1 c600f38927ec576a604eb92a79ef1382c5fe4667
SHA512 90701c663f54a9e85b3888e7e6a555a70532b177b868175ef20970600d1286a0aa6b7ec1fc8ddb9e453d0a6ca0dca966fa80b4ce0862c6ea758705097f2cbcd6
MD5 SHA1 SHA512

Submit Download

RES5CF5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5CF5.tmp
Size 1KB
SHA256 434f5fce8049918b890f1cf5d0a6699ce70dfd9fd340731b940700ffeb1382eb
MD5 ec58f9f467a9492a321b9b4723757df1
SHA1 738be07114399fdc5d7792eaf308d966643ba213
SHA512 a7eb776736c45318cc4e36ccb667e6ca9fba8620515a59ba94d773453e293ce27a9dce3fb54fbf8f64b778a70bbeead5a89c45968ba84e74a675bb60787dc90c
MD5 SHA1 SHA512

Submit Download

tmp5A94.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5A94.tmp.exe
Size 12KB
SHA256 ca53ebc894b0171bbf9460a19c017722fefb2ec8cf92f0eb50989f8ac2fbd53c
MD5 5e540926be141b5e2be81fe2581c6bb6
SHA1 a6e09c98abb995f0d69627fddb32c8d9237c2c64
SHA512 e95d8c14826a20efc98d5d042268c95109d12990369e92c89c79e21a101f41a62f0cbe4aba5dd7b28ca55afd2c58b2e309b94473cfcae6d8f41d78b0a94aedd4
SSDEEP 384:JL7li/2zEq2DcEQvdfcJKLTp/NK9xapD:54MZQ9cpD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc2AA5C5C6DA36483D9B9DF3B926C9CFA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc2AA5C5C6DA36483D9B9DF3B926C9CFA.TMP
Size 1KB
SHA256 134c102bf062e2213c6a3472e5b1820eaa0a86fe57a6aac84175c990d29aed56
MD5 cd27bfa8bfad8b1c6d91792ba6a48d3f
SHA1 71c24bf544ae798580b9df00a2c8833c96f59311
SHA512 c418d249844fd72c776487ac8037a836960aca4abcb026be22e638866301bbab6c34c81b7d3c40a731ed8f763b1e49da87b7d4ad2f366ca63719bce48631ed7f
MD5 SHA1 SHA512

Submit Download

memory/2064-25-0x0000000074620000-0x0000000074DD0000-memory.dmp

Download

memory/2064-26-0x0000000000C70000-0x0000000000C7A000-memory.dmp

Download

memory/2064-27-0x0000000005BF0000-0x0000000006194000-memory.dmp

Download

memory/2064-28-0x0000000005640000-0x00000000056D2000-memory.dmp

Download

memory/2064-30-0x0000000074620000-0x0000000074DD0000-memory.dmp

Download

memory/4368-8-0x0000000074620000-0x0000000074DD0000-memory.dmp

Download

memory/4368-2-0x0000000004CA0000-0x0000000004D3C000-memory.dmp

Download

memory/4368-1-0x0000000000430000-0x000000000043A000-memory.dmp

Download

memory/4368-0-0x000000007462E000-0x000000007462F000-memory.dmp

Download

memory/4368-24-0x0000000074620000-0x0000000074DD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads