4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
104s
max time network
106s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250410-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
14/04/2025, 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f780377dd90d33c8280734d882fc2ac9.exe
Size

12KB
MD5

f780377dd90d33c8280734d882fc2ac9
SHA1

2ca8e1e97f1d9893389ea6f7505fe7c24924b387
SHA256

d44c91defb81890cb0045d3a612485a4db65c1f4e52ce405efa453b8a07229e7
SHA512

ffa397cbe485bef45d52cbe19527bd7e16d5fe3847e80844dbb45fe96effefb8f0c3cfdcfa9d164786a063d6bc74a38c99ec2bab132b3841caaefb72b26be643
SSDEEP

384:SL7li/2zcq2DcEQvdfcJKLTp/NK9xa4f:MYMZQ9c4f

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4097046113-3950943903-3587629992-1000\Control Panel\International\Geo\Nation	f780377dd90d33c8280734d882fc2ac9.exe

Deletes itself 1 IoCs

pid	Process
2240	tmp9B76.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2240	tmp9B76.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9B76.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f780377dd90d33c8280734d882fc2ac9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5548	f780377dd90d33c8280734d882fc2ac9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 1300	5548	f780377dd90d33c8280734d882fc2ac9.exe	81
PID 5548 wrote to memory of 1300	5548	f780377dd90d33c8280734d882fc2ac9.exe	81
PID 5548 wrote to memory of 1300	5548	f780377dd90d33c8280734d882fc2ac9.exe	81
PID 1300 wrote to memory of 3032	1300	vbc.exe	83
PID 1300 wrote to memory of 3032	1300	vbc.exe	83
PID 1300 wrote to memory of 3032	1300	vbc.exe	83
PID 5548 wrote to memory of 2240	5548	f780377dd90d33c8280734d882fc2ac9.exe	84
PID 5548 wrote to memory of 2240	5548	f780377dd90d33c8280734d882fc2ac9.exe	84
PID 5548 wrote to memory of 2240	5548	f780377dd90d33c8280734d882fc2ac9.exe	84

C:\Users\Admin\AppData\Local\Temp\f780377dd90d33c8280734d882fc2ac9.exe
"C:\Users\Admin\AppData\Local\Temp\f780377dd90d33c8280734d882fc2ac9.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iuygwuzo\iuygwuzo.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9CCC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4BE055B74C3B4CA4995F7B2481C23634.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3032
- C:\Users\Admin\AppData\Local\Temp\tmp9B76.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9B76.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f780377dd90d33c8280734d882fc2ac9.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RE.resources

Filesize
2KB

MD5
2a3d4448aae24f7f73988bd942f816b3

SHA1
a89e523ebfe4b0f2d460d752da548e0fa8c3414e

SHA256
f4c019eb4cbbf3f193f827babdd7c1b5b16b176773e5d02e4fb4c287f3447a34

SHA512
4f05dc7ff0356f52a062e0b52f1c4623d4cfb14b6b1202977555473331cb7381ace4cc3703156ee1bbf4d54438d8fd7379b80185bc31b0ee6de3259387493e91

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9CCC.tmp

Filesize
1KB

MD5
6244f81c99e44a9800836125a8cd2c03

SHA1
afa6bb5a94c7d1cc8e2bc8fccfe962529c3b6340

SHA256
f7d23e0ae0f5153b8935d4f3308be735620b090d70a7772519ae4d711cd7074e

SHA512
3afa05e80772ca96de164c7d1f53b691d19a978730614d2377c12715d1cbdf3c8ca635d0ad75e3c71c869ac90ecc78b2e3818477c439f32808117fa6bc8933ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\iuygwuzo\iuygwuzo.0.vb

Filesize
2KB

MD5
5d2b4305f9434c53437f6223ce6d690f

SHA1
d460cff960a1bfe1d1aef6bdbf9c730a11127750

SHA256
37f5832b2d78b10a24c768b693f537907a2f05a2453d47998a53bc8990aca466

SHA512
e365eeae6fa243329f8d82a789af26d2f40e9dbbb9da6405dbe0009d26a07f73674af645f0723079d319f35406aa189c5a0f2988c6ab4e079d6ba8b0dfa6066d

Download Submit
C:\Users\Admin\AppData\Local\Temp\iuygwuzo\iuygwuzo.cmdline

Filesize
273B

MD5
81280887d5d85cc55284b2ccf8fe9b2b

SHA1
01ff2da0e9297f97da3401041dbee58091fbff68

SHA256
1f82025b08de15130b03513a9dfd8fe105c97cdea541f4b6b05969fcd0198eb8

SHA512
3b5a9a75d3d709a9fc443e739de00eabf1c47e8347ac47fde0b7eccba9240496217b6dc3153194284e2c010ebd82cab2334dc89595147a2dd425655046b67c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9B76.tmp.exe

Filesize
12KB

MD5
3cd03ead5abea768b38d43dab8b88987

SHA1
2bf5e8cebb1c1ba8b0c78730a45393070d58c60e

SHA256
a9b47a0cb5fdb77053884dbca5031fa693d773bac291de48ce51aa2d37bb061d

SHA512
d8e0f62f47081830ca72d542db4cf3cfab5b0c4278aeba5165f5a5def96f2479957b80396e6caff375f389da59bc827e518997a34ebec964c7bb8a323e7f92a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc4BE055B74C3B4CA4995F7B2481C23634.TMP

Filesize
1KB

MD5
226d61445488186f74234e9a1c90d65e

SHA1
5676755938de763579b2474bce3d9f293328175a

SHA256
f6bb31b704fc12c04350e4806b9779fe87e95ced1ed4666fa108564dd2d07a4f

SHA512
5b04704bc8a9e4fb6efbd7201e3a501fb29e79e1a394cb008c2c7c76abd23351bffee6bab5a622b1dbbe3d8f0d62d7c3062a45ae259d0e036fe88f85d178d2f1

Download Submit
memory/2240-25-0x0000000074830000-0x0000000074FE1000-memory.dmp

Filesize
7.7MB

Download
memory/2240-26-0x0000000000FD0000-0x0000000000FDA000-memory.dmp

Filesize
40KB

Download
memory/2240-27-0x0000000005E90000-0x0000000006436000-memory.dmp

Filesize
5.6MB

Download
memory/2240-28-0x0000000005980000-0x0000000005A12000-memory.dmp

Filesize
584KB

Download
memory/2240-30-0x0000000074830000-0x0000000074FE1000-memory.dmp

Filesize
7.7MB

Download
memory/5548-0-0x000000007483E000-0x000000007483F000-memory.dmp

Filesize
4KB

Download
memory/5548-8-0x0000000074830000-0x0000000074FE1000-memory.dmp

Filesize
7.7MB

Download
memory/5548-2-0x0000000005250000-0x00000000052EC000-memory.dmp

Filesize
624KB

Download
memory/5548-1-0x00000000008E0000-0x00000000008EA000-memory.dmp

Filesize
40KB

Download
memory/5548-24-0x0000000074830000-0x0000000074FE1000-memory.dmp

Filesize
7.7MB

Download