Analysis
- max time kernel
136s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
22/12/2023, 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe
- Size 1.1MB
- Sample231222-c9ltgahafl
- SHA256 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e
- MD5 3f0576e166dbb3d3a5978985a594ea64
- SHA1 71c3b51076738d22e1f02fcb4371ff4dff2e5a86
- SHA512 77abe8925d6f301b2bafd9879eebcebebde86dec3e895638852b6b52c2e422855facd2d5defa58dd657dea601d10e0d22c80b78d6c370781b0ad5212f46c4225
- SSDEEP 24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyR0:g5ApamAUAQ/lG4lBmFAvZ0
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 2480 svchcst.exe - Executes dropped EXE 2 IoCs
pid Process 2480 svchcst.exe 3908 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 2480 svchcst.exe 2480 svchcst.exe 3908 svchcst.exe 3908 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 868 wrote to memory of 3872 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 92 PID 868 wrote to memory of 4940 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 91 PID 868 wrote to memory of 3872 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 92 PID 868 wrote to memory of 4940 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 91 PID 868 wrote to memory of 3872 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 92 PID 868 wrote to memory of 4940 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 91 PID 868 wrote to memory of 4832 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 93 PID 868 wrote to memory of 4832 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 93 PID 868 wrote to memory of 4832 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 93 PID 868 wrote to memory of 3480 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 90 PID 868 wrote to memory of 3480 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 90 PID 868 wrote to memory of 3480 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 90 PID 3872 wrote to memory of 3908 3872 WScript.exe 96 PID 3872 wrote to memory of 3908 3872 WScript.exe 96 PID 3872 wrote to memory of 3908 3872 WScript.exe 96 PID 4940 wrote to memory of 2480 4940 WScript.exe 97 PID 4940 wrote to memory of 2480 4940 WScript.exe 97 PID 4940 wrote to memory of 2480 4940 WScript.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe"C:\Users\Admin\AppData\Local\Temp\bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
PID:3480
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2480
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3908
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
PID:4832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 60b7961d4a7f712f5bcf4a3c303d831f9af3bb2c8b4b781e41c9adca62d1f262
- MD5 8d112d14e25c16b4ea15f3079519a788
- SHA1 cdabedcf337867a8037d36bcae7d6cf55c1652d7
- SHA512 01f6464b3dad943eba74c9def95e8b81e5f1288af7e679bbc9fb7dcbebd99be3cee2b4c9e54e92c0a23ad1acdd3c844cdd069122867fb2c487cdb3ddb63526e3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 826d4aeebd523fe07f3ac66be72b065a0ae9d3feda70599796344f09ff6e42e9
- MD5 05ecd34e36d8060f7ebef12ed1c0b9b1
- SHA1 286b58f6ddf39d163caf0911f6eed47fcfeb267e
- SHA512 d870903bd4b9a0c11fa008c275b3d0bcae306d9f1a80803ac630f833299a20fb2ad6b32d5b4ba052b8e34e4b82f856ad99db72301f726cc3f2ce94fa810755b7
- SSDEEP 24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyR5:g5ApamAUAQ/lG4lBmFAvZ5
- MD5 SHA1 SHA512 SSDEEP