Overview

overview

7

Static

static

3

bff84ea9e3...ce.exe

windows7-x64

7

bff84ea9e3...ce.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2023, 06:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bff84ea9e39746ab86cea100cf397e02e3be29ca25669ca6a265bb4fe7390dce.exe

  • Size

    1.1MB

  • MD5

    c8756fb8804beecafff062d9dc13d527

  • SHA1

    b6f54a2e03cc548dd85f9294915f59e5eeb96f3b

  • SHA256

    bff84ea9e39746ab86cea100cf397e02e3be29ca25669ca6a265bb4fe7390dce

  • SHA512

    35ff97e90c0c914545bf2b744b26d243d7d68c86c6f0f14d198130606fa735693ddc13f229ee08f1dbbda03453b48598bc8fc45404b55e9faec91b3425f3c9cf

  • SSDEEP

    24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyR7:g5ApamAUAQ/lG4lBmFAvZ7

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bff84ea9e39746ab86cea100cf397e02e3be29ca25669ca6a265bb4fe7390dce.exe
    "C:\Users\Admin\AppData\Local\Temp\bff84ea9e39746ab86cea100cf397e02e3be29ca25669ca6a265bb4fe7390dce.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:260
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3584
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2156
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3660
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1404
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    753B

    MD5

    3de808ca6d4540c79efc371b6e47a81d

    SHA1

    daaccdcbbddbe77aec055c58fcba4f38f28b7a1d

    SHA256

    3d612f0acfac573d681b562e373b2b1194e232d3819ea7b0dfa151ed400e6135

    SHA512

    8e736ba65f63718348b352e3d51e393e1f0131876b427f334b99e37c448d33ff026b4a0dd004109a63120ef41b420f308e097945f512db9bb5c3c3e3d49ac575

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    753B

    MD5

    3de808ca6d4540c79efc371b6e47a81d

    SHA1

    daaccdcbbddbe77aec055c58fcba4f38f28b7a1d

    SHA256

    3d612f0acfac573d681b562e373b2b1194e232d3819ea7b0dfa151ed400e6135

    SHA512

    8e736ba65f63718348b352e3d51e393e1f0131876b427f334b99e37c448d33ff026b4a0dd004109a63120ef41b420f308e097945f512db9bb5c3c3e3d49ac575

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    ea459537dce427dda4599ce7e741478f

    SHA1

    feaa38cf5fa81def42101c3c71d2f5a1cc4ef849

    SHA256

    d418699198d57fc73120c25811e2c3971fa7f07e0112e7646b3fb259d2c5b251

    SHA512

    181c2ce6c9b9da00c3fd659833cfb1898086de891115197f0fa0a1a7c95a0f9c5e111171601b9dea5cab3c823678bfc8d2284d70b457dec4dda4c3c903481a9f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    ea459537dce427dda4599ce7e741478f

    SHA1

    feaa38cf5fa81def42101c3c71d2f5a1cc4ef849

    SHA256

    d418699198d57fc73120c25811e2c3971fa7f07e0112e7646b3fb259d2c5b251

    SHA512

    181c2ce6c9b9da00c3fd659833cfb1898086de891115197f0fa0a1a7c95a0f9c5e111171601b9dea5cab3c823678bfc8d2284d70b457dec4dda4c3c903481a9f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    ea459537dce427dda4599ce7e741478f

    SHA1

    feaa38cf5fa81def42101c3c71d2f5a1cc4ef849

    SHA256

    d418699198d57fc73120c25811e2c3971fa7f07e0112e7646b3fb259d2c5b251

    SHA512

    181c2ce6c9b9da00c3fd659833cfb1898086de891115197f0fa0a1a7c95a0f9c5e111171601b9dea5cab3c823678bfc8d2284d70b457dec4dda4c3c903481a9f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    ea459537dce427dda4599ce7e741478f

    SHA1

    feaa38cf5fa81def42101c3c71d2f5a1cc4ef849

    SHA256

    d418699198d57fc73120c25811e2c3971fa7f07e0112e7646b3fb259d2c5b251

    SHA512

    181c2ce6c9b9da00c3fd659833cfb1898086de891115197f0fa0a1a7c95a0f9c5e111171601b9dea5cab3c823678bfc8d2284d70b457dec4dda4c3c903481a9f

    Download Submit