66745a4257b713585ce8e7b16edd8ae00d247f713ad6ea02dc4c39ef94b8c677

Resubmissions

28-05-2024 10:29

240528-mjl2nafe8z 7

Analysis

max time kernel
134s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DisneyClient.exe
Size

112.3MB
MD5

dfcfc279ead34abb76dc24d0f5a0fbfc
SHA1

bde041a96ad64942543037136b84677b48381e93
SHA256

15266b3ee806793d382388e564d30814ad9a257d1f213840f286838cb6b3a92c
SHA512

1ac73fd15c228b31eb9231d117de148c45f4ae2c132a07ff57a3c58bff8a016f09076591a9941f81310f30e67898d85e1d3feb261d7e236293751fd0d9da56cf
SSDEEP

1572864:XfJBvQqy7wCHw+DqgWucHRifbOsTzVv3V8qekx34mefgprI2wACmucb2M9keuUo2:hBvQbrzMqekphUnCFOec69

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	DisneyClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	DisneyClient.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4708	DisneyClient.exe
4708	DisneyClient.exe
3640	DisneyClient.exe
3640	DisneyClient.exe
4476	DisneyClient.exe
4476	DisneyClient.exe
4476	DisneyClient.exe
4476	DisneyClient.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 3376	4880	DisneyClient.exe	85
PID 4880 wrote to memory of 4708	4880	DisneyClient.exe	86
PID 4880 wrote to memory of 4708	4880	DisneyClient.exe	86
PID 4880 wrote to memory of 4708	4880	DisneyClient.exe	86
PID 4880 wrote to memory of 3640	4880	DisneyClient.exe	87
PID 4880 wrote to memory of 3640	4880	DisneyClient.exe	87
PID 4880 wrote to memory of 3640	4880	DisneyClient.exe	87
PID 4880 wrote to memory of 4476	4880	DisneyClient.exe	97
PID 4880 wrote to memory of 4476	4880	DisneyClient.exe	97
PID 4880 wrote to memory of 4476	4880	DisneyClient.exe	97

C:\Users\Admin\AppData\Local\Temp\DisneyClient.exe
"C:\Users\Admin\AppData\Local\Temp\DisneyClient.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\DisneyClient.exe
  "C:\Users\Admin\AppData\Local\Temp\DisneyClient.exe" --type=gpu-process --field-trial-handle=1604,16832797935390340917,8966618333918684522,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1316 /prefetch:2
  2⤵
  PID:3376
- C:\Users\Admin\AppData\Local\Temp\DisneyClient.exe
  "C:\Users\Admin\AppData\Local\Temp\DisneyClient.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,16832797935390340917,8966618333918684522,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Users\Admin\AppData\Local\Temp\DisneyClient.exe
  "C:\Users\Admin\AppData\Local\Temp\DisneyClient.exe" --type=renderer --field-trial-handle=1604,16832797935390340917,8966618333918684522,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2388 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Users\Admin\AppData\Local\Temp\DisneyClient.exe
  "C:\Users\Admin\AppData\Local\Temp\DisneyClient.exe" --type=gpu-process --field-trial-handle=1604,16832797935390340917,8966618333918684522,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1520 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit