70bba6e748b04c937188f113389a3c90bf30806add70222b920886a57b0bdd98

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12106013cf4b5ee1826ab514eb4f7270.exe
Size

78KB
MD5

12106013cf4b5ee1826ab514eb4f7270
SHA1

2a83fdefe957118925152b578b42fef9382b0bfc
SHA256

a0110b1ca62fd74b4ab17d381a0c8a7872e360dd6e0ff1ba4c570c0f6870006f
SHA512

8f37acb6784224f7411518261b4663a33678fff116ec0de55cb740123cca91a9c1ce9c3cb19209babd52345bd882b9263b1b3b81186f4ef0f32c2b4b85134c58
SSDEEP

1536:nHFo6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtRe9/f1xA:nHFo53Ln7N041QqhgRe9/0

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2656	tmp454.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2656	tmp454.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2740	12106013cf4b5ee1826ab514eb4f7270.exe
2740	12106013cf4b5ee1826ab514eb4f7270.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp454.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12106013cf4b5ee1826ab514eb4f7270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp454.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	12106013cf4b5ee1826ab514eb4f7270.exe
Token: SeDebugPrivilege	2656	tmp454.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 3060	2740	12106013cf4b5ee1826ab514eb4f7270.exe	30
PID 2740 wrote to memory of 3060	2740	12106013cf4b5ee1826ab514eb4f7270.exe	30
PID 2740 wrote to memory of 3060	2740	12106013cf4b5ee1826ab514eb4f7270.exe	30
PID 2740 wrote to memory of 3060	2740	12106013cf4b5ee1826ab514eb4f7270.exe	30
PID 3060 wrote to memory of 2916	3060	vbc.exe	32
PID 3060 wrote to memory of 2916	3060	vbc.exe	32
PID 3060 wrote to memory of 2916	3060	vbc.exe	32
PID 3060 wrote to memory of 2916	3060	vbc.exe	32
PID 2740 wrote to memory of 2656	2740	12106013cf4b5ee1826ab514eb4f7270.exe	33
PID 2740 wrote to memory of 2656	2740	12106013cf4b5ee1826ab514eb4f7270.exe	33
PID 2740 wrote to memory of 2656	2740	12106013cf4b5ee1826ab514eb4f7270.exe	33
PID 2740 wrote to memory of 2656	2740	12106013cf4b5ee1826ab514eb4f7270.exe	33

C:\Users\Admin\AppData\Local\Temp\12106013cf4b5ee1826ab514eb4f7270.exe
"C:\Users\Admin\AppData\Local\Temp\12106013cf4b5ee1826ab514eb4f7270.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\aoblnsm0.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc53E.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
- C:\Users\Admin\AppData\Local\Temp\tmp454.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp454.tmp.exe" C:\Users\Admin\AppData\Local\Temp\12106013cf4b5ee1826ab514eb4f7270.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES53F.tmp

Filesize
1KB

MD5
6e0430d5da991083254ff21f604f1339

SHA1
09a2061d2789551ef15761b29c6bed77de24b69b

SHA256
8604331b515c435cc9b8fd35f86a12e34080e1560b1231e0f61722f86dcc83b2

SHA512
7696c1cee8e25c1ae2078a97a24b8aaca49e07d0953fe38dc7445a7f854c51c7a53544888d4af580e8be0ffbff58cf96bfdf80477f4c823f7fc65108746d13bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\aoblnsm0.0.vb

Filesize
15KB

MD5
536f47ad08bf34b0fc1a39df0bae5a2c

SHA1
e0841fe3cc61d76502dec0abd8924eedf4cb6e86

SHA256
36499e17e0b16da2f5ca7b9f45f65c752183fcbbe9bff702f698414553ceb826

SHA512
9c2892f2852d016827dcaa421b9a779e234349d9855d9dd9f06246adc76bd7a1cd5f011f9d09159d63674b3cad3267ed5ee16428ef622185ae0d809d015f80b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\aoblnsm0.cmdline

Filesize
265B

MD5
c71bb3dd017b770a9e0e0c198092ee6c

SHA1
c9ca816fbd4d7b1516d7a73f8d17533f09dbb747

SHA256
55ceb7303742e315898b1b3c24f6c149e86001ad40ad15ecbedaacf78413d629

SHA512
9d2ac1d5ef55c44b6c96fc4e2001c4e5eae7d489c21a9fe5e7e20ac50b4790d404811c1cde54031c12c37d3659e4dc0597fc4bfc5ed3b0ee7fe5cc431557af8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp454.tmp.exe

Filesize
78KB

MD5
c653ad427bf2f4459499058dc761c473

SHA1
b1fc1dbc42dd1e237b921169492b2b350ac062df

SHA256
7ae40b0b1380879aff90960f93f6f12778a0f99692c4074bed9d8d05701eb1ca

SHA512
ea5f6e131a2c9de1e4003fba0f85d26884eda23e2a9e6cd677c02579f0439c1d279cb6280e305941e102e561919ebcdde57cfc03a2119eb301c41a8bf918471f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc53E.tmp

Filesize
660B

MD5
41142a1265773ef2e8335ab45cb1b0ac

SHA1
f6fccedd4065a7ce6d6faea1c0ae620d789c4320

SHA256
d78321bc470dcddadf38d793ae3426dbda92ed8e0a5de1169898f7abd412e47b

SHA512
51176c4c7b734e73bbd74f210c5dd2aaa48b63ad420acaae10c78eaae8693ec3917636786c66acf91fb51638d43efa7e623a6db03259907da2ec7851f7a01bf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
aa4bdac8c4e0538ec2bb4b7574c94192

SHA1
ef76d834232b67b27ebd75708922adea97aeacce

SHA256
d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

SHA512
0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

Download Submit
memory/2740-0-0x00000000740C1000-0x00000000740C2000-memory.dmp

Filesize
4KB

Download
memory/2740-1-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2740-2-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2740-24-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-8-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-18-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads