Analysis
-
max time kernel
136s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe
-
Size
1.1MB
-
MD5
3f0576e166dbb3d3a5978985a594ea64
-
SHA1
71c3b51076738d22e1f02fcb4371ff4dff2e5a86
-
SHA256
bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e
-
SHA512
77abe8925d6f301b2bafd9879eebcebebde86dec3e895638852b6b52c2e422855facd2d5defa58dd657dea601d10e0d22c80b78d6c370781b0ad5212f46c4225
-
SSDEEP
24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyR0:g5ApamAUAQ/lG4lBmFAvZ0
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation WScript.exe -
Deletes itself 1 IoCs
pid Process 2480 svchcst.exe -
Executes dropped EXE 2 IoCs
pid Process 2480 svchcst.exe 3908 svchcst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 2480 svchcst.exe 2480 svchcst.exe 3908 svchcst.exe 3908 svchcst.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 868 wrote to memory of 3872 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 92 PID 868 wrote to memory of 4940 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 91 PID 868 wrote to memory of 3872 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 92 PID 868 wrote to memory of 4940 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 91 PID 868 wrote to memory of 3872 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 92 PID 868 wrote to memory of 4940 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 91 PID 868 wrote to memory of 4832 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 93 PID 868 wrote to memory of 4832 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 93 PID 868 wrote to memory of 4832 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 93 PID 868 wrote to memory of 3480 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 90 PID 868 wrote to memory of 3480 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 90 PID 868 wrote to memory of 3480 868 bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe 90 PID 3872 wrote to memory of 3908 3872 WScript.exe 96 PID 3872 wrote to memory of 3908 3872 WScript.exe 96 PID 3872 wrote to memory of 3908 3872 WScript.exe 96 PID 4940 wrote to memory of 2480 4940 WScript.exe 97 PID 4940 wrote to memory of 2480 4940 WScript.exe 97 PID 4940 wrote to memory of 2480 4940 WScript.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe"C:\Users\Admin\AppData\Local\Temp\bf0e0f456990806edfcdd0094952a648e76ecc64ef7c34dbd7f46409c9b3a55e.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
PID:3480
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2480
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3908
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
PID:4832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753B
MD58d112d14e25c16b4ea15f3079519a788
SHA1cdabedcf337867a8037d36bcae7d6cf55c1652d7
SHA25660b7961d4a7f712f5bcf4a3c303d831f9af3bb2c8b4b781e41c9adca62d1f262
SHA51201f6464b3dad943eba74c9def95e8b81e5f1288af7e679bbc9fb7dcbebd99be3cee2b4c9e54e92c0a23ad1acdd3c844cdd069122867fb2c487cdb3ddb63526e3
-
Filesize
1.1MB
MD505ecd34e36d8060f7ebef12ed1c0b9b1
SHA1286b58f6ddf39d163caf0911f6eed47fcfeb267e
SHA256826d4aeebd523fe07f3ac66be72b065a0ae9d3feda70599796344f09ff6e42e9
SHA512d870903bd4b9a0c11fa008c275b3d0bcae306d9f1a80803ac630f833299a20fb2ad6b32d5b4ba052b8e34e4b82f856ad99db72301f726cc3f2ce94fa810755b7