ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe
Size 78KB
Sample241006-ftf5tsxfpg
SHA256 ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49
MD5 03c6c1ac9facc479f183944aa329f600
SHA1 d7c2c682e59e68fdcd161ad4cc48834000c0702d
SHA512 fe1958190a343a95cfa2fab2babb1b99afe75abed571e1ac4239dcd6e33661258515a15ed3e42a2b10f5498c4dec2cf40bc8e327a690b10e817c5f3491e8ced3
SSDEEP 1536:RJRWtHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtR69/t1oA:/RWtHa3Ln7N041QqhgR69/d
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe

Deletes itself 1 IoCs

pid	Process
3116	tmp8482.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3116	tmp8482.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp8482.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8482.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3980	ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe
Token: SeDebugPrivilege	3116	tmp8482.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4372	3980	ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe	82
PID 3980 wrote to memory of 4372	3980	ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe	82
PID 3980 wrote to memory of 4372	3980	ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe	82
PID 4372 wrote to memory of 3060	4372	vbc.exe	84
PID 4372 wrote to memory of 3060	4372	vbc.exe	84
PID 4372 wrote to memory of 3060	4372	vbc.exe	84
PID 3980 wrote to memory of 3116	3980	ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe	85
PID 3980 wrote to memory of 3116	3980	ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe	85
PID 3980 wrote to memory of 3116	3980	ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe	85

C:\Users\Admin\AppData\Local\Temp\ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe
"C:\Users\Admin\AppData\Local\Temp\ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3-ydu3xf.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85AB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc299080769729445384E766351BFA21FD.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3060
- C:\Users\Admin\AppData\Local\Temp\tmp8482.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8482.tmp.exe" C:\Users\Admin\AppData\Local\Temp\ef5f24b4185f14123455a3fb70bd78e1b4f377a8c7d746907b5902ebacc98f49N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3-ydu3xf.0.vb

Path C:\Users\Admin\AppData\Local\Temp\3-ydu3xf.0.vb
Size 15KB
SHA256 526fec1e066cf3954ff19f7335e0949936fa4f02aef4964462916b859f32fa13
MD5 0721bf65cdc49afceebbb257006d4239
SHA1 07aac63b56b2e2b435f45260f0b3c8975397c55d
SHA512 00d9a5573cd5b0ac19a2decdc2056c010e62144893ddfc626ffbc8cc1c330e341ae4c4b8fb5137bfd49c2f53f987b3f290352dc4542895829a9dfe1cedc59b58
SSDEEP 384:r8VNwvNv6NJFNv9ZNcONplcHbjE6NLFzN7QASN7eP:wwVvmJ3NciTcHzLFht+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

3-ydu3xf.cmdline

Path C:\Users\Admin\AppData\Local\Temp\3-ydu3xf.cmdline
Size 266B
SHA256 dadae4109f58ac5011d8612669574a9333fa18b49b06c6770e62624acb7c6cc2
MD5 64794a52ed688ef7e771c636650e4f1b
SHA1 2ad6da0d29015c472c07df7c71e79ba926e0d72f
SHA512 b0459782c0fc7dc117a514ea963a131883794ec46561727f36ac1a51bd9036581d47b8090ea8395bc9667cd9877df7216cd7edd58dd837f24330c5c56184bfa8
MD5 SHA1 SHA512

Submit Download

RES85AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES85AB.tmp
Size 1KB
SHA256 083a22e006e60f94f0f5fed7e4ab3376cc00e5b4ab4adcf912b5f9667b82afd0
MD5 7a32a52d0324c3ce98fa99dde7c8e5fc
SHA1 8a959dba2988db61ffd09eb62d89fea65f294e9b
SHA512 8c4c6c6c8b59188858a9491351f7dfc4f190270788eb4658ea85f69d70f0460dfdf59303b6e01682c6481283c6ebc15e70697a0a9b3275954e0ea46f93ce6e2c
MD5 SHA1 SHA512

Submit Download

tmp8482.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp8482.tmp.exe
Size 78KB
SHA256 0fc70e55377ed626e1a71d4cba1814cdd4a3fd8993de262299168c7df3d18946
MD5 6308ab2595e914e07f7828febf45f7b6
SHA1 0cc7b5e5439c0e76c323af16a0e12efdbbc18d25
SHA512 e224e60e249c8ea18dc0a97877d21ae346f8b25ba34d2fb9b56cd52a29fe5ba67ebd048ac949c1abf46146349315b4c9bd1fbceb04bd51b0436ad370afd6db04
SSDEEP 1536:By58Vdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC619/9w1Uv:By58An7N041Qqhgt9/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc299080769729445384E766351BFA21FD.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc299080769729445384E766351BFA21FD.TMP
Size 660B
SHA256 5266b11945a5c986a15bf7f30996fad1b190fa810b390f1a18bc1866342d4e78
MD5 9bd8bb7d473e8f5e06bcf3f390690ac1
SHA1 eec28e68e6dfc6cf7e04e61a375ed06725793a24
SHA512 7da2750aa46cd334e68e4fe70e5bb5b6741730d10ed752aa5d078acffe3fe3cfa8abe885feafa1fb143383783bfd9a04876852c9a48249efc848734e8f099953
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3116-24-0x0000000074CD0000-0x0000000075281000-memory.dmp

Download

memory/3116-23-0x0000000074CD0000-0x0000000075281000-memory.dmp

Download

memory/3116-26-0x0000000074CD0000-0x0000000075281000-memory.dmp

Download

memory/3116-27-0x0000000074CD0000-0x0000000075281000-memory.dmp

Download

memory/3116-28-0x0000000074CD0000-0x0000000075281000-memory.dmp

Download

memory/3980-2-0x0000000074CD0000-0x0000000075281000-memory.dmp

Download

memory/3980-1-0x0000000074CD0000-0x0000000075281000-memory.dmp

Download

memory/3980-22-0x0000000074CD0000-0x0000000075281000-memory.dmp

Download

memory/3980-0-0x0000000074CD2000-0x0000000074CD3000-memory.dmp

Download

memory/4372-8-0x0000000074CD0000-0x0000000075281000-memory.dmp

Download

memory/4372-18-0x0000000074CD0000-0x0000000075281000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads