Overview
overview
8Static
static
3MicrosoftW...ll.bat
windows7-x64
1MicrosoftW...ll.bat
windows10-2004-x64
1MicrosoftW...nc.vbs
windows7-x64
3MicrosoftW...nc.vbs
windows10-2004-x64
7MicrosoftW...un.vbs
windows7-x64
3MicrosoftW...un.vbs
windows10-2004-x64
7MicrosoftW...dy.exe
windows7-x64
8MicrosoftW...dy.exe
windows10-2004-x64
8MicrosoftW...or.exe
windows7-x64
3MicrosoftW...or.exe
windows10-2004-x64
7MicrosoftW...ch.exe
windows7-x64
1MicrosoftW...ch.exe
windows10-2004-x64
1MicrosoftW...er.exe
windows7-x64
3MicrosoftW...er.exe
windows10-2004-x64
7MicrosoftW...ew.exe
windows7-x64
8MicrosoftW...ew.exe
windows10-2004-x64
8MicrosoftW...le.exe
windows7-x64
3MicrosoftW...le.exe
windows10-2004-x64
7MicrosoftW...od.exe
windows7-x64
1MicrosoftW...od.exe
windows10-2004-x64
1MicrosoftW...er.bat
windows7-x64
MicrosoftW...er.bat
windows10-2004-x64
MicrosoftW...32.exe
windows7-x64
1MicrosoftW...32.exe
windows10-2004-x64
1MicrosoftW...2s.exe
windows7-x64
4MicrosoftW...2s.exe
windows10-2004-x64
7MicrosoftW...le.vbs
windows7-x64
3MicrosoftW...le.vbs
windows10-2004-x64
7MicrosoftW...ec.vbs
windows7-x64
1MicrosoftW...ec.vbs
windows10-2004-x64
1MicrosoftW...en.vbs
windows7-x64
3MicrosoftW...en.vbs
windows10-2004-x64
7Analysis
-
max time kernel
123s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 23:24
Static task
static1
Behavioral task
behavioral1
Sample
MicrosoftWindowsServicesEtc/AppKill.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
MicrosoftWindowsServicesEtc/AppKill.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
MicrosoftWindowsServicesEtc/CallFunc.vbs
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
MicrosoftWindowsServicesEtc/CallFunc.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
MicrosoftWindowsServicesEtc/DgzRun.vbs
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
MicrosoftWindowsServicesEtc/DgzRun.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
MicrosoftWindowsServicesEtc/GetReady.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
MicrosoftWindowsServicesEtc/GetReady.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
MicrosoftWindowsServicesEtc/Major.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
MicrosoftWindowsServicesEtc/Major.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
MicrosoftWindowsServicesEtc/NotMuch.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
MicrosoftWindowsServicesEtc/NotMuch.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
MicrosoftWindowsServicesEtc/WinScrew.exe
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
MicrosoftWindowsServicesEtc/WinScrew.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
MicrosoftWindowsServicesEtc/breakrule.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
MicrosoftWindowsServicesEtc/breakrule.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
MicrosoftWindowsServicesEtc/bsod.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
MicrosoftWindowsServicesEtc/bsod.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
MicrosoftWindowsServicesEtc/checker.bat
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
MicrosoftWindowsServicesEtc/checker.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
MicrosoftWindowsServicesEtc/data/eula32.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
MicrosoftWindowsServicesEtc/data/eula32.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
MicrosoftWindowsServicesEtc/data/runner32s.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
MicrosoftWindowsServicesEtc/data/runner32s.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
MicrosoftWindowsServicesEtc/example.vbs
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
MicrosoftWindowsServicesEtc/example.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
MicrosoftWindowsServicesEtc/fexec.vbs
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
MicrosoftWindowsServicesEtc/fexec.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
MicrosoftWindowsServicesEtc/healgen.vbs
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
MicrosoftWindowsServicesEtc/healgen.vbs
Resource
win10v2004-20240226-en
General
-
Target
MicrosoftWindowsServicesEtc/healgen.vbs
-
Size
302B
-
MD5
8837818893ce61b6730dd8a83d625890
-
SHA1
a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614
-
SHA256
cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb
-
SHA512
6f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WScript.exedescription pid process target process PID 2840 wrote to memory of 4884 2840 WScript.exe wscript.exe PID 2840 wrote to memory of 4884 2840 WScript.exe wscript.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\healgen.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Program Files\MicrosoftWindowsServicesEtc\healgen.vbs" RunAsAdministrator2⤵PID:4884
-