579b90e2ac3f15921d4a49998dd395645a8d0aab142d4765ca29f84be465840d

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
Size

617KB
MD5

3386773652cab6d42e5eb77f33b414c2
SHA1

46af3a4f285a71a1f27b67e79359d980612226b4
SHA256

6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d
SHA512

cd6f3a152ae82ea19686f83d26eac06e888dfe753bb8fc863570a2a1a6db3b9c5fedf910b71e2d40886c07d650c4b35faf69c1f322560bc67539728b9aceb7c2
SSDEEP

12288:l2iKVaUqdJS4Vo5pLRpHiANQ6elKQI64i55oc:Y+UgSckQ61Qd4iToc

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3640	powershell.exe
704	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
3640	powershell.exe
704	powershell.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
3640	powershell.exe
704	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	3640	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3640	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	92
PID 4624 wrote to memory of 3640	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	92
PID 4624 wrote to memory of 3640	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	92
PID 4624 wrote to memory of 704	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	94
PID 4624 wrote to memory of 704	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	94
PID 4624 wrote to memory of 704	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	94
PID 4624 wrote to memory of 636	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	96
PID 4624 wrote to memory of 636	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	96
PID 4624 wrote to memory of 636	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	96
PID 4624 wrote to memory of 2964	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	98
PID 4624 wrote to memory of 2964	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	98
PID 4624 wrote to memory of 2964	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	98
PID 4624 wrote to memory of 1416	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	99
PID 4624 wrote to memory of 1416	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	99
PID 4624 wrote to memory of 1416	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	99
PID 4624 wrote to memory of 4116	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	100
PID 4624 wrote to memory of 4116	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	100
PID 4624 wrote to memory of 4116	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	100
PID 4624 wrote to memory of 4568	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	101
PID 4624 wrote to memory of 4568	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	101
PID 4624 wrote to memory of 4568	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	101
PID 4624 wrote to memory of 4612	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	102
PID 4624 wrote to memory of 4612	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	102
PID 4624 wrote to memory of 4612	4624	6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe	102

C:\Users\Admin\AppData\Local\Temp\6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe
"C:\Users\Admin\AppData\Local\Temp\6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZFDfJPJOzHNzUJ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:704
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZFDfJPJOzHNzUJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9124.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
378904389986cf3580b7fc12a707809d

SHA1
b31a53c58a34b6ae7c32b4a314842b648b9f4269

SHA256
64e17a4672db4083dbe80f0303583a1efb666d7644ed24d74898ce0df6a53d06

SHA512
fd6b177a73807f1fd2004520e1123ab6f6e0ffc67235742f0b0830dca8bf3c41e5e22694da72c0b0ac3dd2949320b22eb77f00534ceb5ce241c0aef7bb761043

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_umkyaz4p.yfc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9124.tmp

Filesize
1KB

MD5
076f016fdf50032304c602e84b1f9103

SHA1
14c71f574e404c6c551a6659763095d2dd0aeef4

SHA256
ed488d5ced21a7c3e9de0a3cefc8db6a486380d549065d3fed84c6f7c5f980e1

SHA512
9ca0527f08952eeb6b4a8fc94fb01cdf7d699aa7a7939eca7dac2f7d99cc96bec79e9b220fb02adbdbf7400d7142407967e86725736b789df94766797fdfa388

Download Submit
memory/704-64-0x0000000075180000-0x00000000751CC000-memory.dmp

Filesize
304KB

Download
memory/704-21-0x0000000005930000-0x0000000005952000-memory.dmp

Filesize
136KB

Download
memory/704-88-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/704-81-0x0000000007F50000-0x0000000007F6A000-memory.dmp

Filesize
104KB

Download
memory/704-79-0x0000000007E40000-0x0000000007E4E000-memory.dmp

Filesize
56KB

Download
memory/704-78-0x0000000007E10000-0x0000000007E21000-memory.dmp

Filesize
68KB

Download
memory/704-77-0x0000000007E90000-0x0000000007F26000-memory.dmp

Filesize
600KB

Download
memory/704-22-0x00000000061B0000-0x0000000006216000-memory.dmp

Filesize
408KB

Download
memory/704-46-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/704-23-0x00000000062D0000-0x0000000006336000-memory.dmp

Filesize
408KB

Download
memory/704-32-0x0000000006340000-0x0000000006694000-memory.dmp

Filesize
3.3MB

Download
memory/704-24-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/704-19-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/3640-74-0x0000000007EA0000-0x000000000851A000-memory.dmp

Filesize
6.5MB

Download
memory/3640-63-0x0000000007740000-0x00000000077E3000-memory.dmp

Filesize
652KB

Download
memory/3640-89-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/3640-18-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/3640-82-0x0000000007B80000-0x0000000007B88000-memory.dmp

Filesize
32KB

Download
memory/3640-80-0x0000000007AA0000-0x0000000007AB4000-memory.dmp

Filesize
80KB

Download
memory/3640-17-0x00000000056F0000-0x0000000005D18000-memory.dmp

Filesize
6.2MB

Download
memory/3640-76-0x00000000078D0000-0x00000000078DA000-memory.dmp

Filesize
40KB

Download
memory/3640-49-0x0000000006540000-0x000000000655E000-memory.dmp

Filesize
120KB

Download
memory/3640-31-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/3640-50-0x0000000006980000-0x00000000069CC000-memory.dmp

Filesize
304KB

Download
memory/3640-16-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/3640-52-0x0000000075180000-0x00000000751CC000-memory.dmp

Filesize
304KB

Download
memory/3640-51-0x0000000007500000-0x0000000007532000-memory.dmp

Filesize
200KB

Download
memory/3640-62-0x0000000006AF0000-0x0000000006B0E000-memory.dmp

Filesize
120KB

Download
memory/3640-15-0x0000000002C10000-0x0000000002C46000-memory.dmp

Filesize
216KB

Download
memory/3640-75-0x0000000007860000-0x000000000787A000-memory.dmp

Filesize
104KB

Download
memory/4624-3-0x0000000005720000-0x00000000057B2000-memory.dmp

Filesize
584KB

Download
memory/4624-4-0x00000000058E0000-0x00000000058EA000-memory.dmp

Filesize
40KB

Download
memory/4624-5-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/4624-14-0x00000000748FE000-0x00000000748FF000-memory.dmp

Filesize
4KB

Download
memory/4624-9-0x000000000AB50000-0x000000000ABEC000-memory.dmp

Filesize
624KB

Download
memory/4624-8-0x0000000006D70000-0x0000000006DD2000-memory.dmp

Filesize
392KB

Download
memory/4624-0-0x00000000748FE000-0x00000000748FF000-memory.dmp

Filesize
4KB

Download
memory/4624-7-0x0000000006B20000-0x0000000006B30000-memory.dmp

Filesize
64KB

Download
memory/4624-48-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/4624-2-0x0000000005C30000-0x00000000061D4000-memory.dmp

Filesize
5.6MB

Download
memory/4624-1-0x0000000000DF0000-0x0000000000E90000-memory.dmp

Filesize
640KB

Download
memory/4624-6-0x0000000006B00000-0x0000000006B18000-memory.dmp

Filesize
96KB

Download
memory/4624-25-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download