5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe
Size 12KB
Sample240602-2jfl7she7x
SHA256 5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f
MD5 90140da9dd0064d5e7e7faeef8df6058
SHA1 187ad926180b3aac26b47001819ad301d650f528
SHA512 49776fb6f01a63582f92209ded62a4979064d96de94a74ecbede1569adac132ae894912ddb6eee388e3d63159a5b0434c11a5e289fc70fd2f534a1e60a1039ff
SSDEEP 384:GL7li/2zXq2DcEQvdQcJKLTp/NK9xa5F:gTMCQ9c5F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe

Deletes itself 1 IoCs

pid	Process
396	tmp11BF.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
396	tmp11BF.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3560	4656	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	90
PID 4656 wrote to memory of 3560	4656	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	90
PID 4656 wrote to memory of 3560	4656	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	90
PID 3560 wrote to memory of 3876	3560	vbc.exe	92
PID 3560 wrote to memory of 3876	3560	vbc.exe	92
PID 3560 wrote to memory of 3876	3560	vbc.exe	92
PID 4656 wrote to memory of 396	4656	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	93
PID 4656 wrote to memory of 396	4656	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	93
PID 4656 wrote to memory of 396	4656	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	93

C:\Users\Admin\AppData\Local\Temp\5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe
"C:\Users\Admin\AppData\Local\Temp\5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wvgi2hxc\wvgi2hxc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES30B0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc39B546E95413430699225FB3BA98A5DA.TMP"
    3⤵
    PID:3876
- C:\Users\Admin\AppData\Local\Temp\tmp11BF.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp11BF.tmp.exe" C:\Users\Admin\AppData\Local\Temp\5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 15edc98886be58076e464cffceefad18c78e7bf0868bdba8cc57d1cba1914f56
MD5 1a72061aa16f3221434fff97ee2fa94d
SHA1 a0869f4cb5b02fcac18b32d73b64e1ec28473463
SHA512 33747b03b47dab4e2a2cec42b743e22abf49c3d545ce683e987cd93a879b13224541c07c594848bae1f1d2a8122ff52220c31e8bd6d846571d2da034cc41235d
MD5 SHA1 SHA512

Submit Download

RES30B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES30B0.tmp
Size 1KB
SHA256 d76f8d9dd6bee5a6d540bceadadbcaea81a7d5df00825aadeb1616bc6c09c23d
MD5 4afa14aad7ac810eac32cee375dacf20
SHA1 9a1b34a9964efcd454e1ee8ee8f1dd074e015eb8
SHA512 ac7e62ac462a815b472efc898fdd768092b290f37dea99c10afa0ca17f98d52df738ef5b3d95774bb0066d35314b6a65f898d67563b31e6c8c1bf9bc2ddc0ea7
MD5 SHA1 SHA512

Submit Download

tmp11BF.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp11BF.tmp.exe
Size 12KB
SHA256 2d750bb8298c328bc9bb797df97dbd03ab696c146d66fab9a1cab8cd16149f3f
MD5 bdb3abe69f6518ada3e376fa77a3c120
SHA1 13c982743fa069a5e2e1c84cd40e9291e6c77681
SHA512 6d3f2eff54a8ba4493303f126b2d15c8436ed304fc3886a77eb39c6abbe1f4a83c812d008a100a754cd28504a067cb871249a59ec7757401ee75a5d34527122c
SSDEEP 384:HL7li/2znq2DcEQvdfcJKLTp/NK9xauU:rzMZQ9cuU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc39B546E95413430699225FB3BA98A5DA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc39B546E95413430699225FB3BA98A5DA.TMP
Size 1KB
SHA256 bc365e4fbd85c90176228d962c35249abe652357266a0193bc312b5ae5e2cf34
MD5 e87d9f573c6dec1e6208fa7ca70778a5
SHA1 987fc2c39b1c3e839e18276328b3dbe7d92bfa2f
SHA512 c7bd5c7f27be7853e5137b7677cf18098c672623a18c55644402eacb425d10f78ba0f73dd93178b7bbf2068a8e8a3645fb36c3eb5e716f9d26e00810248ae74a
MD5 SHA1 SHA512

Submit Download

wvgi2hxc.0.vb

Path C:\Users\Admin\AppData\Local\Temp\wvgi2hxc\wvgi2hxc.0.vb
Size 2KB
SHA256 344a8fca28cba9301285e23a00eda52df4a5cab80ffb13d9733fc670bc978d6a
MD5 8487049c5a7cc7cb6bfeb7e4764dec2f
SHA1 0520caa0c4b9ed58350e16f5796ad841c754e455
SHA512 9e00dc93ba70e238374ac4c5124b81d8ccba02b0f5fab16a4c00cee743e70d93fb85b0fd8d2d317e725583a7b9b97a604996dc0241c08b2a25474c493c44148a
MD5 SHA1 SHA512

Submit Download

wvgi2hxc.cmdline

Path C:\Users\Admin\AppData\Local\Temp\wvgi2hxc\wvgi2hxc.cmdline
Size 273B
SHA256 15fb62f4851141954bb2d6959967c02219dcb5aad9da2d9fd814e8d13c1e8df2
MD5 28d581cf2bd4122f1f56501b04cfcf28
SHA1 b8cabce47def34146082890414154f5b2946e1d5
SHA512 6a4fd6a721dc004bd738660dca4b76eb9768c34aca060ad8cec617a25f835890a19c9d765813297bac97821dab2d6a84770a649f4251d28ca8250d28080b9679
MD5 SHA1 SHA512

Submit Download

memory/396-23-0x00000000000E0000-0x00000000000EA000-memory.dmp

Download

memory/396-24-0x0000000074B80000-0x0000000075330000-memory.dmp

Download

memory/396-27-0x0000000005000000-0x00000000055A4000-memory.dmp

Download

memory/396-28-0x0000000004AF0000-0x0000000004B82000-memory.dmp

Download

memory/396-30-0x0000000074B80000-0x0000000075330000-memory.dmp

Download

memory/4656-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Download

memory/4656-7-0x0000000074B80000-0x0000000075330000-memory.dmp

Download

memory/4656-2-0x0000000004B90000-0x0000000004C2C000-memory.dmp

Download

memory/4656-1-0x00000000001F0000-0x00000000001FA000-memory.dmp

Download

memory/4656-26-0x0000000074B80000-0x0000000075330000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads