06eff0b0dc021ab79b61bc72aff871df18c73bc518b9a7116124f86828ea630c

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06eff0b0dc021ab79b61bc72aff871df18c73bc518b9a7116124f86828ea630c.exe
Size 1.1MB
Sample240614-bdqbcayelf
SHA256 06eff0b0dc021ab79b61bc72aff871df18c73bc518b9a7116124f86828ea630c
MD5 ec61712c6c60c8249e591ea6d64db59a
SHA1 1692ee6f1e0a6bf32407a781dd4c9aba3a737d26
SHA512 f1317454e15a8fdb1a407ea3c38d53fb6b422b878f721f701bae1c60a5ae5590dbe50b60ece1bd7d811bd8087669ae5c331b2ace1af76948d102c82ff864fda6
SSDEEP 24576:W6nVMk+HIj90cNHX7Jp4KQJeyYFZdCWoeemJsIbWxkwIkKBqSI1xij9O:NVz7tVrJG/JeVZiYJ6xEkrSeic
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	06eff0b0dc021ab79b61bc72aff871df18c73bc518b9a7116124f86828ea630c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	06eff0b0dc021ab79b61bc72aff871df18c73bc518b9a7116124f86828ea630c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 3204	1624	06eff0b0dc021ab79b61bc72aff871df18c73bc518b9a7116124f86828ea630c.exe	80
PID 1624 wrote to memory of 3204	1624	06eff0b0dc021ab79b61bc72aff871df18c73bc518b9a7116124f86828ea630c.exe	80
PID 1624 wrote to memory of 3204	1624	06eff0b0dc021ab79b61bc72aff871df18c73bc518b9a7116124f86828ea630c.exe	80

C:\Users\Admin\AppData\Local\Temp\06eff0b0dc021ab79b61bc72aff871df18c73bc518b9a7116124f86828ea630c.exe
"C:\Users\Admin\AppData\Local\Temp\06eff0b0dc021ab79b61bc72aff871df18c73bc518b9a7116124f86828ea630c.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xepm.vbe"
  2⤵
  PID:3204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xepm.vbe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\xepm.vbe
Size 113KB
SHA256 86b89a4e4ac35f94ed0335d811a5876497762d52a5be99b27b73c9d8d8d097cc
MD5 33501205e81570bb9df5c3958d002638
SHA1 01c26d2b651680acc4b7d6a04064b7a8e514cb4a
SHA512 abe4bef198a6e803ef591cb19c7773ef5c1bca8049366e5b6acf5701121f307e59fd8279bc1e7fc93d12352a9112ff27a846a8219cfd2fb4a5c16b5556d2f3c9
SSDEEP 768:C00000000000fRRRRRRRRRRRVCCCCCCCCC3rrrrrrrrrr+LLLLLLLLLLLLLLLLLw:tz4
MD5 SHA1 SHA512 SSDEEP

Submit Download