f633e07a4128fe6fc2ebf45fc6557d95d592d85a91b4fd1b1ca2d24ab3a3afef

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f633e07a4128fe6fc2ebf45fc6557d95d592d85a91b4fd1b1ca2d24ab3a3afef.exe
Size

746KB
MD5

c573e16cdb7c80bb8ec9990ce9703625
SHA1

28729600a0d12b0cc95d8e5b114e0e123b7e67f2
SHA256

f633e07a4128fe6fc2ebf45fc6557d95d592d85a91b4fd1b1ca2d24ab3a3afef
SHA512

6972502184c2ae9045f52033642d37f2c44a6babc4cd0ba3c0e43f804501b9eae821835e0a410f07e682e3fedf77c2249ab168a1c9993dfad0c8ae53667b74d8
SSDEEP

12288:vVbnhCmgqTp0/Ioqdl7Z01YFF3vOLI1CyjLsiydCoKsiB7228T50OixGNKbT:NzExi5Z5T3vO2ifKsiB778T+OiuKv

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4332-0-0x00000000001F0000-0x000000000035B000-memory.dmp	vmprotect
behavioral2/memory/4332-1-0x00000000001F0000-0x000000000035B000-memory.dmp	vmprotect

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f633e07a4128fe6fc2ebf45fc6557d95d592d85a91b4fd1b1ca2d24ab3a3afef.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4332	f633e07a4128fe6fc2ebf45fc6557d95d592d85a91b4fd1b1ca2d24ab3a3afef.exe
Token: SeRestorePrivilege	4332	f633e07a4128fe6fc2ebf45fc6557d95d592d85a91b4fd1b1ca2d24ab3a3afef.exe

C:\Users\Admin\AppData\Local\Temp\f633e07a4128fe6fc2ebf45fc6557d95d592d85a91b4fd1b1ca2d24ab3a3afef.exe
"C:\Users\Admin\AppData\Local\Temp\f633e07a4128fe6fc2ebf45fc6557d95d592d85a91b4fd1b1ca2d24ab3a3afef.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4332-0-0x00000000001F0000-0x000000000035B000-memory.dmp

Filesize
1.4MB

Download
memory/4332-1-0x00000000001F0000-0x000000000035B000-memory.dmp

Filesize
1.4MB

Download