9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
Size

1.1MB
MD5

145c96bbf0160209b619626e64813cb4
SHA1

50d51cbf5c9d3e58ecdbee28eacde3d37fb2de98
SHA256

9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d
SHA512

6fef27be6ce9a55ecf6652265bfe221d293af0fd143fb8abc33fc9dc483a5ef6d4830f55e1edfd7871c90257e3e69ab9bf08adeaa3c23d276a7868b8155cd0e8
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qz:CcaClSFlG4ZM7QzMk

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe

Deletes itself 1 IoCs

pid	Process
776	svchcst.exe

Executes dropped EXE 6 IoCs

pid	Process
4504	svchcst.exe
4064	svchcst.exe
776	svchcst.exe
5068	svchcst.exe
1928	svchcst.exe
3568	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe
776	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
4064	svchcst.exe
4064	svchcst.exe
4504	svchcst.exe
776	svchcst.exe
4504	svchcst.exe
776	svchcst.exe
5068	svchcst.exe
5068	svchcst.exe
1928	svchcst.exe
1928	svchcst.exe
3568	svchcst.exe
3568	svchcst.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2164	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	100
PID 224 wrote to memory of 2164	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	100
PID 224 wrote to memory of 2164	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	100
PID 224 wrote to memory of 4900	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	97
PID 224 wrote to memory of 4900	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	97
PID 224 wrote to memory of 1820	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	96
PID 224 wrote to memory of 1820	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	96
PID 224 wrote to memory of 1820	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	96
PID 224 wrote to memory of 4900	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	97
PID 224 wrote to memory of 3104	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	101
PID 224 wrote to memory of 3104	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	101
PID 224 wrote to memory of 3104	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	101
PID 224 wrote to memory of 3896	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	98
PID 224 wrote to memory of 3896	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	98
PID 224 wrote to memory of 3896	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	98
PID 224 wrote to memory of 1920	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	99
PID 224 wrote to memory of 1920	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	99
PID 224 wrote to memory of 1920	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	99
PID 224 wrote to memory of 3516	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	95
PID 224 wrote to memory of 3516	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	95
PID 224 wrote to memory of 3516	224	9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe	95
PID 1820 wrote to memory of 4504	1820	WScript.exe	106
PID 1820 wrote to memory of 4504	1820	WScript.exe	106
PID 1820 wrote to memory of 4504	1820	WScript.exe	106
PID 3104 wrote to memory of 4064	3104	WScript.exe	107
PID 3104 wrote to memory of 4064	3104	WScript.exe	107
PID 3104 wrote to memory of 4064	3104	WScript.exe	107
PID 4900 wrote to memory of 776	4900	WScript.exe	108
PID 4900 wrote to memory of 776	4900	WScript.exe	108
PID 4900 wrote to memory of 776	4900	WScript.exe	108
PID 3516 wrote to memory of 5068	3516	WScript.exe	109
PID 3516 wrote to memory of 5068	3516	WScript.exe	109
PID 3516 wrote to memory of 5068	3516	WScript.exe	109
PID 2164 wrote to memory of 1928	2164	WScript.exe	110
PID 2164 wrote to memory of 1928	2164	WScript.exe	110
PID 2164 wrote to memory of 1928	2164	WScript.exe	110
PID 1920 wrote to memory of 3568	1920	WScript.exe	111
PID 1920 wrote to memory of 3568	1920	WScript.exe	111
PID 1920 wrote to memory of 3568	1920	WScript.exe	111

C:\Users\Admin\AppData\Local\Temp\9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe
"C:\Users\Admin\AppData\Local\Temp\9b0c792999a00f8ffc04b71c7a3a7b86fd04c53eb752276b3bc723231447748d.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5068
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4504
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:776
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  PID:3896
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3568
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1928
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
1a8b830c1841347942b3767a9ba670fc

SHA1
ad5baf29c3ba34a7afb6075c85f78ac6834d98b0

SHA256
665680495c4271f14095014b2facf0771fea9bc5a112c9f33bc640ed1129e34d

SHA512
f776929a4c33e214adbeba9542c81456d19d6c6925538b02db36ef06214268b3c515dbb37caa4f3e9b4377bc4da7eb26907402f86e61d441c2aa40d94fdd1290

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
1.1MB

MD5
c62631d15f16518189cddd997db85461

SHA1
806ef515c6d1351e00c1f2269ac29feb9729435f

SHA256
6e41de216b35ad19a54073fc4b87b0ca20af1799f09135cab8c83d0f62f2b939

SHA512
2a670e2ad1e7d4317a6624ed5a0f3fe5b5e76ab1747dc44fd3ceb2e11393e57bedfa05bdbd8ad814c36066a346498fe5f368cbf0f0c28bcb01d171d3f47f0e5a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
73KB

MD5
847d4dae37abbc28632af3a544da0ab3

SHA1
6035c4596edc7459f32806efccb3d6f091f0e81f

SHA256
ed7bbfaa027c45904cf7607c0caeda8a5a09711dd62918db058aa6d04975a77f

SHA512
906d27d5bbf332d58181d1b08e621f9541fca72ca82122b378b396e1acfe3ec6755c829d8fe6ffa27c81e5616b1b73e04b78d901f478d4f3c7b47310b3b26cc5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
320KB

MD5
6ea1b316d03c44519a34bc8c266a3d15

SHA1
42fc178558e3979fd432c87e52be58ef721872d5

SHA256
8d5abb93ee10590924437d3e249982dd502c8533f0c73f8eb8af0275a3b803bc

SHA512
3c2941536f35ccc12b4f4f51a59a7fdbd6ec054c9604fa4c8bb27dee009ae1abcfa179a70f9ac1ff6b5dabf5a6ffbc8842aed16fb9a0af17b19e3c6879c236f6

Download Submit