Overview

overview

7

Static

static

3

29ebdb9401...a7.exe

windows7-x64

7

29ebdb9401...a7.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    138s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2023, 03:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    29ebdb9401581febfc42093998c74c9bd5d1491017277e1b03511712b48b0fa7.exe

  • Size

    1.1MB

  • MD5

    641be73b9dbe2367c986068410f9c6ed

  • SHA1

    5f6c75a91471eae5427955192e849c76515c1598

  • SHA256

    29ebdb9401581febfc42093998c74c9bd5d1491017277e1b03511712b48b0fa7

  • SHA512

    4227d85e53d08b6395e27242cb48c106eaffb3481e398efb8ec32ca7ada9deb8277181b24d9e7c568a01f180916dff209bc43fc490edeb6256a54788e96ce219

  • SSDEEP

    24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyRM:g5ApamAUAQ/lG4lBmFAvZM

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29ebdb9401581febfc42093998c74c9bd5d1491017277e1b03511712b48b0fa7.exe
    "C:\Users\Admin\AppData\Local\Temp\29ebdb9401581febfc42093998c74c9bd5d1491017277e1b03511712b48b0fa7.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3852
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3212
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2044
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2240
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1960

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
          Filesize

          753B

          MD5

          bc9ec3f519ab175deabef53f22838596

          SHA1

          4489026417ab91bb56a89cc7a04a86eb660aacdf

          SHA256

          9b1ce2570c2b7afb5795a70b54fa72cfdf0b0ad059fecb66ab13a46c9e4e2129

          SHA512

          25907b0d7059d9191829867c2b57ea35e4a49162ab1a5c219b60d42f067b61c72e5f75501134c90138ac92fdd5d4d5b8bebb95439017131876a72a83b48dd52f

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
          Filesize

          753B

          MD5

          bc9ec3f519ab175deabef53f22838596

          SHA1

          4489026417ab91bb56a89cc7a04a86eb660aacdf

          SHA256

          9b1ce2570c2b7afb5795a70b54fa72cfdf0b0ad059fecb66ab13a46c9e4e2129

          SHA512

          25907b0d7059d9191829867c2b57ea35e4a49162ab1a5c219b60d42f067b61c72e5f75501134c90138ac92fdd5d4d5b8bebb95439017131876a72a83b48dd52f

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
          Filesize

          1.1MB

          MD5

          620da0487004b2e3c41e0cdbe299b9e2

          SHA1

          18fcb76ad9dae6f105887928eacf93d7a38de4da

          SHA256

          9796a6ae294e154616b36867aa6286e5b12bd102af06f41a294a20d792fcc827

          SHA512

          210e8151c926ceb21112a704660f5298017844eff4400afa03b902c4c086ebec395cd0746fa62e36eec749c01eda810e225af6523591105c3771edf38d85d4f0

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
          Filesize

          1.1MB

          MD5

          620da0487004b2e3c41e0cdbe299b9e2

          SHA1

          18fcb76ad9dae6f105887928eacf93d7a38de4da

          SHA256

          9796a6ae294e154616b36867aa6286e5b12bd102af06f41a294a20d792fcc827

          SHA512

          210e8151c926ceb21112a704660f5298017844eff4400afa03b902c4c086ebec395cd0746fa62e36eec749c01eda810e225af6523591105c3771edf38d85d4f0

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
          Filesize

          1.1MB

          MD5

          620da0487004b2e3c41e0cdbe299b9e2

          SHA1

          18fcb76ad9dae6f105887928eacf93d7a38de4da

          SHA256

          9796a6ae294e154616b36867aa6286e5b12bd102af06f41a294a20d792fcc827

          SHA512

          210e8151c926ceb21112a704660f5298017844eff4400afa03b902c4c086ebec395cd0746fa62e36eec749c01eda810e225af6523591105c3771edf38d85d4f0

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
          Filesize

          1.1MB

          MD5

          620da0487004b2e3c41e0cdbe299b9e2

          SHA1

          18fcb76ad9dae6f105887928eacf93d7a38de4da

          SHA256

          9796a6ae294e154616b36867aa6286e5b12bd102af06f41a294a20d792fcc827

          SHA512

          210e8151c926ceb21112a704660f5298017844eff4400afa03b902c4c086ebec395cd0746fa62e36eec749c01eda810e225af6523591105c3771edf38d85d4f0

          Download Submit