Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
General
-
Target
380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe
-
Size
1.1MB
-
MD5
805cc740136e4935b8b796601e7ea697
-
SHA1
15a4ac632e7dea6ef5744a1f7301cb36f5aa0e07
-
SHA256
380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907
-
SHA512
4408ad772d0c57bfa30e1c0bc8015c84163d3bead7d375393373b9b1774b7dd58444468492d44d9b7311f444cc56851cc60def4cca1acaf231a67dbd7e001b55
-
SSDEEP
24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QN:CcaClSFlG4ZM7QzMm
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exeWScript.exeWScript.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation WScript.exe -
Deletes itself 1 IoCs
Processes:
svchcst.exepid Process 4584 svchcst.exe -
Executes dropped EXE 2 IoCs
Processes:
svchcst.exesvchcst.exepid Process 4584 svchcst.exe 112 svchcst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
Processes:
WScript.exeWScript.exe380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exesvchcst.exepid Process 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe 4584 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exepid Process 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exesvchcst.exesvchcst.exepid Process 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 4584 svchcst.exe 4584 svchcst.exe 112 svchcst.exe 112 svchcst.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exeWScript.exeWScript.exedescription pid Process procid_target PID 4600 wrote to memory of 4868 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 89 PID 4600 wrote to memory of 4868 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 89 PID 4600 wrote to memory of 4868 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 89 PID 4600 wrote to memory of 2708 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 90 PID 4600 wrote to memory of 2708 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 90 PID 4600 wrote to memory of 2708 4600 380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe 90 PID 2708 wrote to memory of 4584 2708 WScript.exe 93 PID 2708 wrote to memory of 4584 2708 WScript.exe 93 PID 2708 wrote to memory of 4584 2708 WScript.exe 93 PID 4868 wrote to memory of 112 4868 WScript.exe 92 PID 4868 wrote to memory of 112 4868 WScript.exe 92 PID 4868 wrote to memory of 112 4868 WScript.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe"C:\Users\Admin\AppData\Local\Temp\380ef6b062746f2c2a8631a7851b07ac2b64492637509e0cc577240a7a891907.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:112
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4584
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753B
MD52db50e925945b30dce18b3a872508882
SHA1d2ef10036ea16e4ea75026e3a0c0894409172b55
SHA25621221d9c0c3e5d60f5baa30797eafd8aae22d70a168d05bb5ad262df88591db3
SHA5122c54d45cb270caaba91ddd12f2eaaf01ec68c0d5ba234521e802fc462ca10830c8c976cdfec68338c828dfadd399bc4a7b9f8e5f48f8e3b99dde41c262c9f977
-
Filesize
1.1MB
MD58791c5205b8ec6cb1cd4d4c51ecc3adf
SHA13e515dc50e3de3ce6a750f29e21d586734364e1a
SHA2564824cc251ab8b85936072ee82e3d3869c3c36b27d0b52b3846e26b3b4bfa9f90
SHA51215b3bef94414ebac1424d2bb46de705d4f7104de69e3b1c82d76f8b12b0dd36eb10c16c3ec4af160550c6835343bbb48b7165468c7529917ad34d67469ba0ca3