668ef0cbbba392e41123ff053035c5754b0106c7aa447d8be8462e1687af2ab3

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

668ef0cbbba392e41123ff053035c5754b0106c7aa447d8be8462e1687af2ab3.exe
Size

3.9MB
MD5

198445ccfde3c7d3008fcdc4d0f4ea96
SHA1

c28cbcd5d5a5c95d4e85664cde0b4272f98dcf1d
SHA256

668ef0cbbba392e41123ff053035c5754b0106c7aa447d8be8462e1687af2ab3
SHA512

35faa63ac38843e2532741406ca44275020d2b4d2ee8fea0a9a23399318e3f2022691b2be110d6e4b921599d76c2d3eb21d40849c01a4df595e40d9e4cd795a5
SSDEEP

49152:IBJBZDwpx4hvBLbw/T6aFOcyZhEKkD4J5Q6cCVneVJRZY+NOvC250KUfn1Y7ZvKV:y/5wpa8T6aFZA4LCoJRNbD1YVuOnE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	668ef0cbbba392e41123ff053035c5754b0106c7aa447d8be8462e1687af2ab3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	HyperportwinSession.exe

Executes dropped EXE 2 IoCs

pid	Process
2568	HyperportwinSession.exe
1044	sihost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\sihost.exe	HyperportwinSession.exe
File created	C:\Program Files\Windows Mail\66fc9ff0ee96c2	HyperportwinSession.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\bcastdvr\System.exe	HyperportwinSession.exe
File opened for modification	C:\Windows\bcastdvr\System.exe	HyperportwinSession.exe
File created	C:\Windows\bcastdvr\27d1bcfc3c54e0	HyperportwinSession.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	668ef0cbbba392e41123ff053035c5754b0106c7aa447d8be8462e1687af2ab3.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	HyperportwinSession.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe
2568	HyperportwinSession.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1044	sihost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	HyperportwinSession.exe
Token: SeDebugPrivilege	1044	sihost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 2944	4432	668ef0cbbba392e41123ff053035c5754b0106c7aa447d8be8462e1687af2ab3.exe	81
PID 4432 wrote to memory of 2944	4432	668ef0cbbba392e41123ff053035c5754b0106c7aa447d8be8462e1687af2ab3.exe	81
PID 4432 wrote to memory of 2944	4432	668ef0cbbba392e41123ff053035c5754b0106c7aa447d8be8462e1687af2ab3.exe	81
PID 2944 wrote to memory of 3176	2944	WScript.exe	89
PID 2944 wrote to memory of 3176	2944	WScript.exe	89
PID 2944 wrote to memory of 3176	2944	WScript.exe	89
PID 3176 wrote to memory of 2568	3176	cmd.exe	91
PID 3176 wrote to memory of 2568	3176	cmd.exe	91
PID 2568 wrote to memory of 1304	2568	HyperportwinSession.exe	92
PID 2568 wrote to memory of 1304	2568	HyperportwinSession.exe	92
PID 1304 wrote to memory of 4540	1304	cmd.exe	94
PID 1304 wrote to memory of 4540	1304	cmd.exe	94
PID 1304 wrote to memory of 3352	1304	cmd.exe	95
PID 1304 wrote to memory of 3352	1304	cmd.exe	95
PID 1304 wrote to memory of 1044	1304	cmd.exe	96
PID 1304 wrote to memory of 1044	1304	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\668ef0cbbba392e41123ff053035c5754b0106c7aa447d8be8462e1687af2ab3.exe
"C:\Users\Admin\AppData\Local\Temp\668ef0cbbba392e41123ff053035c5754b0106c7aa447d8be8462e1687af2ab3.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ComproviderintobrokerNet\NWVATf5YrTd8g96j7TYVg4ALh0T0CEgN16rZ6pCUCuA0.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ComproviderintobrokerNet\PDQ7LoGhnqrW1weWu8.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\ComproviderintobrokerNet\HyperportwinSession.exe
      "C:\ComproviderintobrokerNet/HyperportwinSession.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c5ENaD5VN7.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1304
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4540
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3352
      - C:\Program Files\Windows Mail\sihost.exe
        
        "C:\Program Files\Windows Mail\sihost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ComproviderintobrokerNet\HyperportwinSession.exe

Filesize
3.5MB

MD5
21e3c4d0fb2808d93061a24051b1cd1d

SHA1
7e9e8dcf0502aa11ff27312ad275bdc58f7ff840

SHA256
616b81d389a5914d515a375e2c1fcdcb2ddb8ac1e28c5d01c9a006b7ea458b27

SHA512
0853119735fc5e2fe4fac068bfbb52ad80457adcaefae179fbe4fd2a1c1bbe6589e61f881ec6bb9e42cd88b63b200883305c5a12702df72ec2102a81428399b6

Download Submit
C:\ComproviderintobrokerNet\NWVATf5YrTd8g96j7TYVg4ALh0T0CEgN16rZ6pCUCuA0.vbe

Filesize
221B

MD5
d656a1b6958129671674c11c642c97ed

SHA1
000e73d933503c7fcccffbe8b53abb56db7fe32f

SHA256
9e156bb87dcd429b33b01284272931d40cadb5b084ea7999c820d9443b1a828b

SHA512
e40fda724d71820e11e9398ff15b9f97fd550344a6767009f6310534e09504d56b9206dd2abf81b65417282e8406e845e2857d887fe450346a023e01cce30ee7

Download Submit
C:\ComproviderintobrokerNet\PDQ7LoGhnqrW1weWu8.bat

Filesize
100B

MD5
494988d014dee882cd6df819ea7a5c38

SHA1
543c33f979b255564b93b5965f4c783548bcaee5

SHA256
500780e72faf5d90928affb6cb2e285cfa9f9a025fb289243c3eb7ee7aac7c41

SHA512
fb732fb2ee57635635f85b72b2bffdea3e4c25aece684d20f575858adc22e3efc5146b4d866cdac6d0f0c23e02672d3eba0ab3b8637876e1cb2c6510b69450b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5ENaD5VN7.bat

Filesize
216B

MD5
8846b106ab82b99b4ddaa1f490dac3b7

SHA1
f03997401e79e4664990c6ed4ba5c0d5b0782b94

SHA256
59aa2a24e75574c14553de478a38eae54a790a6a7c209ad1351d1e164f38acfd

SHA512
236b7caf42b5070b42cd7a440363992fb8432b5e4c5cb1828753ed765e41e1f8f6a3f0a33a8a6d19cb901966606da81aca94a5c36468ac663925731292f6883b

Download Submit
memory/1044-101-0x000000001DB70000-0x000000001DC85000-memory.dmp

Filesize
1.1MB

Download
memory/2568-32-0x000000001CB50000-0x000000001CB5E000-memory.dmp

Filesize
56KB

Download
memory/2568-40-0x000000001CC50000-0x000000001CC62000-memory.dmp

Filesize
72KB

Download
memory/2568-20-0x000000001CBA0000-0x000000001CBF0000-memory.dmp

Filesize
320KB

Download
memory/2568-22-0x0000000002E20000-0x0000000002E30000-memory.dmp

Filesize
64KB

Download
memory/2568-19-0x0000000002E70000-0x0000000002E8C000-memory.dmp

Filesize
112KB

Download
memory/2568-24-0x000000001CB70000-0x000000001CB88000-memory.dmp

Filesize
96KB

Download
memory/2568-26-0x0000000002E30000-0x0000000002E40000-memory.dmp

Filesize
64KB

Download
memory/2568-28-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Filesize
64KB

Download
memory/2568-30-0x000000001B980000-0x000000001B98E000-memory.dmp

Filesize
56KB

Download
memory/2568-15-0x0000000002E40000-0x0000000002E66000-memory.dmp

Filesize
152KB

Download
memory/2568-34-0x000000001CC10000-0x000000001CC22000-memory.dmp

Filesize
72KB

Download
memory/2568-36-0x000000001CB60000-0x000000001CB70000-memory.dmp

Filesize
64KB

Download
memory/2568-38-0x000000001CC30000-0x000000001CC46000-memory.dmp

Filesize
88KB

Download
memory/2568-17-0x0000000002E10000-0x0000000002E1E000-memory.dmp

Filesize
56KB

Download
memory/2568-41-0x000000001D1A0000-0x000000001D6C8000-memory.dmp

Filesize
5.2MB

Download
memory/2568-43-0x000000001CB90000-0x000000001CB9E000-memory.dmp

Filesize
56KB

Download
memory/2568-45-0x000000001CBF0000-0x000000001CC00000-memory.dmp

Filesize
64KB

Download
memory/2568-47-0x000000001CC00000-0x000000001CC10000-memory.dmp

Filesize
64KB

Download
memory/2568-49-0x000000001CCD0000-0x000000001CD2A000-memory.dmp

Filesize
360KB

Download
memory/2568-51-0x000000001CC70000-0x000000001CC7E000-memory.dmp

Filesize
56KB

Download
memory/2568-53-0x000000001CC80000-0x000000001CC90000-memory.dmp

Filesize
64KB

Download
memory/2568-55-0x000000001CC90000-0x000000001CC9E000-memory.dmp

Filesize
56KB

Download
memory/2568-57-0x000000001CD30000-0x000000001CD48000-memory.dmp

Filesize
96KB

Download
memory/2568-59-0x000000001CDA0000-0x000000001CDEE000-memory.dmp

Filesize
312KB

Download
memory/2568-13-0x0000000000860000-0x0000000000BF2000-memory.dmp

Filesize
3.6MB

Download
memory/2568-12-0x00007FF815A33000-0x00007FF815A35000-memory.dmp

Filesize
8KB

Download