6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe
Size 12KB
Sample240607-a6ymraef7w
SHA256 6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0
MD5 0ea427b7664cbe9fb723d89ec32158f7
SHA1 29862f8f1ba307c3f60433545b00d1c7cc3281b2
SHA512 c6c086fa82d0d89899f5fbeace4a5a2053099b49ea7f74cef22b4cbe23f1e80271249475a3fa5efd7f88baf0aa3508b78c6e7b37c19cbbdae29bdd9e5396e766
SSDEEP 384:tL7li/2z5q2DcEQvdhcJKLTp/NK9xal1:9ZM/Q9cl1
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe

Deletes itself 1 IoCs

pid	Process
2564	tmp3E23.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2564	tmp3E23.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 3040	1976	6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe	85
PID 1976 wrote to memory of 3040	1976	6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe	85
PID 1976 wrote to memory of 3040	1976	6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe	85
PID 3040 wrote to memory of 3984	3040	vbc.exe	87
PID 3040 wrote to memory of 3984	3040	vbc.exe	87
PID 3040 wrote to memory of 3984	3040	vbc.exe	87
PID 1976 wrote to memory of 2564	1976	6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe	88
PID 1976 wrote to memory of 2564	1976	6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe	88
PID 1976 wrote to memory of 2564	1976	6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe	88

C:\Users\Admin\AppData\Local\Temp\6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe
"C:\Users\Admin\AppData\Local\Temp\6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\44uuveh4\44uuveh4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EFD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc246E8BC4CEF14C879B5DDBA4CFF9971D.TMP"
    3⤵
    PID:3984
- C:\Users\Admin\AppData\Local\Temp\tmp3E23.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3E23.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6ea3ab9b0430e8afc8a86659ed214a10c2d495fb88462d9136b255f1a17f6ea0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44uuveh4.0.vb

Path C:\Users\Admin\AppData\Local\Temp\44uuveh4\44uuveh4.0.vb
Size 2KB
SHA256 dfa24b613b574698345085cbc65a0651268fb625cadeedc26cabff59da5f21b1
MD5 a5442b9c08165666a1cf8ee3790ad0a2
SHA1 c33cfa1b97e6f0f21455882f73ecb38d9318a246
SHA512 5a092ac08c212a8dd46a8ec7ff03ee855f80c1522595d0c5aa4a69f0b8b1d20059eaf578dc09ee7157bc5f604aec0b557d4fad8d5e14fbc9f8af10952fe3873f
MD5 SHA1 SHA512

Submit Download

44uuveh4.cmdline

Path C:\Users\Admin\AppData\Local\Temp\44uuveh4\44uuveh4.cmdline
Size 273B
SHA256 9dab583e1deb28730a2cd4aeb29c9b6a0b1c3f1afc8682be57297f5e7add1002
MD5 d872472901852b07ce59ed20b123491e
SHA1 49e2200785608fc097a8d185b4a6293729057131
SHA512 cfbf72d6d9dfc0854da83b3416ff1793b2600ae4a0fed4dca4386f210626ac1d13c8389042def46cd5074ee8a96723e9dd1863fbafb389527d3a278f54679238
MD5 SHA1 SHA512

Submit Download

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 2e2fc845a35b69e0166a155f885c30a98fe21b05d3d543b2fb1a3ba7830d4a9e
MD5 ac8b851ef8b0ec7664bd387faea83373
SHA1 38fdd49b7cc1afe9429ff078ffbd38feadf16063
SHA512 4c7eb282db3c387e1001ba542d4c38c92bb9260470db8497126e62e24b39c0c362feba7865ff64494e093391b8e0528d14ac93b021e60910508d591032ec7623
MD5 SHA1 SHA512

Submit Download

RES3EFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3EFD.tmp
Size 1KB
SHA256 75c638b833de2b5abd1a61d96ab459162620dc838d60a14dcb8de1762dfb5106
MD5 8502ddd5fbcbf993371a9b68e9f46a96
SHA1 c9dde5325db0493c76fe5d745114dd093d44c6b5
SHA512 96061f1e58a8ae772d6c74ac1a160ab0d42989db05cbb7e93370fbdf007e47e046c54c1937ce910e4d5a7e0a41e2dca6adc3b5679c21e5dd05bfa44620611da2
MD5 SHA1 SHA512

Submit Download

tmp3E23.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3E23.tmp.exe
Size 12KB
SHA256 0dd537a262e9c49fe5bb883fab027a02122e9e2d799d0fa1580291a2a35395e6
MD5 7a83323f944932526ffe8fe2465576fe
SHA1 3651b53c1a88bbd818a9d288a6219f237a7559a6
SHA512 508b7571c193bbaf54aa368df79a49ca7fcb1a99b3e9f3653ae55deecf0542bcea3d0ab1c94bdf090ece7d99da630709bd0d032bc99b66e5220dab0683e507bf
SSDEEP 384:HL7li/2zfq2DcEQvdfcJKLTp/NK9xaeIV:rzMZQ9crV
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc246E8BC4CEF14C879B5DDBA4CFF9971D.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc246E8BC4CEF14C879B5DDBA4CFF9971D.TMP
Size 1KB
SHA256 cc3df968e9749ad3f27e30dddd8be418c4abe5b5c8d3b95c78c6fdecec186ef0
MD5 7bc1457c551d8e8a71c75a42ec71ba82
SHA1 cf66caabfea8eb53fc430d4dcb6f5c8172bf061f
SHA512 ead556e153aceaeda5e2d3aaeca077905e0c76daaf56aa20b6c05e72e94cb7442ded428dc65aa5e178303349283cf719aa9a90985c3a5763a6472af0446e7cbe
MD5 SHA1 SHA512

Submit Download

memory/1976-8-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/1976-2-0x0000000005500000-0x000000000559C000-memory.dmp

Download

memory/1976-1-0x0000000000B60000-0x0000000000B6A000-memory.dmp

Download

memory/1976-0-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

Download

memory/1976-24-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/2564-25-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/2564-26-0x00000000009D0000-0x00000000009DA000-memory.dmp

Download

memory/2564-27-0x00000000058C0000-0x0000000005E64000-memory.dmp

Download

memory/2564-28-0x00000000053B0000-0x0000000005442000-memory.dmp

Download

memory/2564-30-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads