f30ea0f7276100d02319bee64445888af5d784eb12a962ea88f99d2ae4137897

Analysis

max time kernel
92s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MicrosoftWindowsServicesEtc/CallFunc.vbs
Size 388B
Sample240302-3d17dsag33
SHA256 a767894a68ebc490cb5ab2b7b04dd12b7465553ce7ba7e41e1ea45f1eaef5275
MD5 5f9737f03289963a6d7a71efab0813c4
SHA1 ba22dfae8d365cbf8014a630f23f1d8574b5cf85
SHA512 5f4fb691e6da90e8e0872378a7b78cbd1acbf2bd75d19d65f17bf5b1cea95047d66b79fd1173703fcfef42cfc116ca629b9b37e355e44155e8f3b98f2d916a2a
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1344	532	WScript.exe	89
PID 532 wrote to memory of 1344	532	WScript.exe	89
PID 532 wrote to memory of 1344	532	WScript.exe	89
PID 1344 wrote to memory of 3936	1344	majorlist.exe	90
PID 1344 wrote to memory of 3936	1344	majorlist.exe	90

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\CallFunc.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:532
- C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\majorlist.exe
  "C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\majorlist.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1\3DC4.bat C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\majorlist.exe"
    3⤵
    PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3DC4.bat

Path C:\Users\Admin\AppData\Local\Temp\1\3DC4.bat
Size 116B
SHA256 f695721ea49576dc9b10b2d3c6ba89e8880b9a330b471e89800d014cb45de210
MD5 0db153eefb4d51d0f0b699ea1d97b98d
SHA1 abd0cc67716a9a3e6b0838638011d0594d329935
SHA512 057edee55b797b2349b8f59e89c819ad868d773f7f58a4b1c26aac5bb04f783708127cd18af51f074f838498a3e3d96d143ad285c2cc7e4e4ad5e6973d9a4a10
MD5 SHA1 SHA512

Submit Download