b7a2def2630cbbca20d06f0d40ceaf00f8df471adb12f62efbeb513681cf4878

Analysis

max time kernel
104s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2025, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quarantine/VcYJXcL.exe
Size

13.5MB
MD5

a42a7864ee588e5627a17cc5b36a8cae
SHA1

3713244300e87a512ad10382571c98a08fd13155
SHA256

3d4915f94462dda1b3af5ca1ee39740e14644807fb743403e55c7b9a92101b7f
SHA512

2b86e5a3d0dcea2aa30731edbc1bf30251b1f5c0ebb24fcee772f8c9f4b0c1d5e11b8ebc633b4c4fd15f301dba0caf67114502e142efb5af3789114dd1a4490e
SSDEEP

393216:7lzh+J9e0FamFZOt7NUIaaHXDUJFbSflHjB0DjY31Z1CPwDv3uFh:7lz2s0FfZ2DUJFbSflHjB0Djm

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	VcYJXcL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2472	3588	VcYJXcL.exe	88
PID 3588 wrote to memory of 2472	3588	VcYJXcL.exe	88

C:\Users\Admin\AppData\Local\Temp\quarantine\VcYJXcL.exe
"C:\Users\Admin\AppData\Local\Temp\quarantine\VcYJXcL.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c (for /L %i in (0,1,15) do (del "C:\Users\Admin\AppData\Local\Temp\QUARAN~1\VcYJXcL.exe" & if not exist "C:\Users\Admin\AppData\Local\Temp\QUARAN~1\VcYJXcL.exe" (rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\QUARAN~1\VcYJXcL.exe" & exit)))
  2⤵
  PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads