bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe
Size 12KB
Sample240609-jvb42sgf48
SHA256 bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015
MD5 b3025a44dd8c24ce11916990dbea9b50
SHA1 92f2782b049755d9076baba1c6413b18fd9ab6ea
SHA512 b5686131e067de2d2d3e839832b3fe36f9824ff4322368a5e00c1621bfbd1169f49938cd478bc607d3c3b294e51b6f8a31f94603e17dcdf67e0395cb7d939f2c
SSDEEP 384:NL7li/2z+q2DcEQvdhcJKLTp/NK9xa5T:dOM/Q9c5T
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe

Deletes itself 1 IoCs

pid	Process
5100	tmp4C6B.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
5100	tmp4C6B.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1168	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1840	1168	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	88
PID 1168 wrote to memory of 1840	1168	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	88
PID 1168 wrote to memory of 1840	1168	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	88
PID 1840 wrote to memory of 2768	1840	vbc.exe	90
PID 1840 wrote to memory of 2768	1840	vbc.exe	90
PID 1840 wrote to memory of 2768	1840	vbc.exe	90
PID 1168 wrote to memory of 5100	1168	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	91
PID 1168 wrote to memory of 5100	1168	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	91
PID 1168 wrote to memory of 5100	1168	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	91

C:\Users\Admin\AppData\Local\Temp\bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe
"C:\Users\Admin\AppData\Local\Temp\bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tr33g2us\tr33g2us.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D64.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc90AA99D79F4C46E08185CCD7197B4D33.TMP"
    3⤵
    PID:2768
- C:\Users\Admin\AppData\Local\Temp\tmp4C6B.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4C6B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 4633bc55882b7c8a8958dae52caa90b0d657a2100bb899fc5d80dfa0b387c577
MD5 536f2e763174f3e27846faf7b3cca656
SHA1 a4c7fc425cb5d6e8a0d2304f79e15a9644f89297
SHA512 ec78b5d6799546515051ac5ac69f52ee7e91f66468835566781ef26b7954bb007b6d9d62bf3bd096f8d70ef62c149003f71cf346d50679aed004acc79664b469
MD5 SHA1 SHA512

Submit Download

RES4D64.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4D64.tmp
Size 1KB
SHA256 a2c91c61e858c53f2abe753d6ed3c075941c31f3709d643f34db89578e8d6e56
MD5 24c6ed0ba03c4fb151db7ecbfb900839
SHA1 db1fcd99eb50d328372fca0f9cf3652a1be8afb8
SHA512 ffd3797ad8970ff182da02039339aaedb2f2adb648ab91e054c58d17d0a0d90e70a84b15c753382879bb68c5599ef17e679fe2d22dde9b248687747e5d3b917f
MD5 SHA1 SHA512

Submit Download

tmp4C6B.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4C6B.tmp.exe
Size 12KB
SHA256 e91a34354d28900b382e1efc2dc5ade0393790e29210207bc6d0c7fb99098a71
MD5 c8702a75d6a774de82b527b47c7efaf3
SHA1 ca7d4513f889519e73af06a09942539c264b00f4
SHA512 b90de720564823e8c6d0e8756d43b292a9090c135f967f0df8c05d76c977f37e3638ef5e2838c8b21f51c57d96d0662b88fa4c667440e1a718d01e5e0700f3bd
SSDEEP 384:jL7li/2zSq2DcEQvdfcJKLTp/NK9xaqh:nKMZQ9cqh
MD5 SHA1 SHA512 SSDEEP

Submit Download

tr33g2us.0.vb

Path C:\Users\Admin\AppData\Local\Temp\tr33g2us\tr33g2us.0.vb
Size 2KB
SHA256 177f23e8c91c89f8605f7c34efff76e6539bcf919f89328c5c172d40f801bd99
MD5 20da6931ce4fa87080f6231ffffc584b
SHA1 6322a2fac8154a57e35e48c3386061edae4f88a6
SHA512 9d7aa220322b6185e466476139fae1a4ba642e1c54562f7147cd41959670f707e810f6f72795f5120b4cbbc32758b47f476995ca6c0608cd71c9011f8295e924
MD5 SHA1 SHA512

Submit Download

tr33g2us.cmdline

Path C:\Users\Admin\AppData\Local\Temp\tr33g2us\tr33g2us.cmdline
Size 273B
SHA256 418bd5474558281270aaea62e326ef85eadb5dc16bf0ce543781a99c8cfac869
MD5 a0e0283c96019d46a1ce8c32da576a37
SHA1 830766053afd2eeec248c10af41aa5f4015ce811
SHA512 a9b1df5385e59bc36650123ec7923638e5b8a7743d0f31ca9088d51be930b52c76bd9db4e25b7ad617d46da8dde62fcb2c4f4823f52c49bd88e2d77fa2e8b527
MD5 SHA1 SHA512

Submit Download

vbc90AA99D79F4C46E08185CCD7197B4D33.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc90AA99D79F4C46E08185CCD7197B4D33.TMP
Size 1KB
SHA256 7b2338c01e2d9d598f713ee37d704076280e05a388c0f56d89432c211ed321f7
MD5 eb94fe85d1cbf89c022c5179413a3025
SHA1 aa4d157c41a4f5cfab61802389dad37208234740
SHA512 40dd8c236da35888e9daa96f69e197b50520d4bd859e652cc1cb4ce3cbf675125e577e8541cc7fd48e1ee9e67af25712b3288293551f360ca281823de7e48660
MD5 SHA1 SHA512

Submit Download

memory/1168-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

Download

memory/1168-8-0x00000000746D0000-0x0000000074E80000-memory.dmp

Download

memory/1168-2-0x0000000005180000-0x000000000521C000-memory.dmp

Download

memory/1168-1-0x0000000000720000-0x000000000072A000-memory.dmp

Download

memory/1168-24-0x00000000746D0000-0x0000000074E80000-memory.dmp

Download

memory/5100-25-0x0000000000C90000-0x0000000000C9A000-memory.dmp

Download

memory/5100-26-0x00000000746D0000-0x0000000074E80000-memory.dmp

Download

memory/5100-27-0x0000000005B30000-0x00000000060D4000-memory.dmp

Download

memory/5100-28-0x0000000005620000-0x00000000056B2000-memory.dmp

Download

memory/5100-30-0x00000000746D0000-0x0000000074E80000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads