Analysis
- max time kernel
92s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 20:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe
- Size 1.1MB
- Sample240528-y2k3vsbg73
- SHA256 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517
- MD5 2240fd4a79ac8d048221e383efd80e12
- SHA1 3616bfff8962aa80e5089b7573aeaf2e775cad20
- SHA512 d700cb5a844cf4b15722aed567997475336213d3d011c15768e898caf24bcf988b9c5c53061515745e55f860a755ef3529b7cfa065ff20563c03a9cd2b5d8128
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qj:CcaClSFlG4ZM7QzMU
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 1876 svchcst.exe - Executes dropped EXE 4 IoCs
pid Process 1876 svchcst.exe 1492 svchcst.exe 4028 svchcst.exe 2324 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings svchcst.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 540 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe 540 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe 540 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe 540 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 540 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 540 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe 540 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe 1876 svchcst.exe 1876 svchcst.exe 1492 svchcst.exe 1492 svchcst.exe 4028 svchcst.exe 4028 svchcst.exe 2324 svchcst.exe 2324 svchcst.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 540 wrote to memory of 4880 540 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe 82 PID 540 wrote to memory of 4880 540 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe 82 PID 540 wrote to memory of 4880 540 a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe 82 PID 4880 wrote to memory of 1876 4880 WScript.exe 91 PID 4880 wrote to memory of 1876 4880 WScript.exe 91 PID 4880 wrote to memory of 1876 4880 WScript.exe 91 PID 1876 wrote to memory of 212 1876 svchcst.exe 93 PID 1876 wrote to memory of 212 1876 svchcst.exe 93 PID 1876 wrote to memory of 212 1876 svchcst.exe 93 PID 1876 wrote to memory of 2888 1876 svchcst.exe 94 PID 1876 wrote to memory of 2888 1876 svchcst.exe 94 PID 1876 wrote to memory of 2888 1876 svchcst.exe 94 PID 2888 wrote to memory of 1492 2888 WScript.exe 97 PID 2888 wrote to memory of 1492 2888 WScript.exe 97 PID 2888 wrote to memory of 1492 2888 WScript.exe 97 PID 1492 wrote to memory of 4208 1492 svchcst.exe 99 PID 1492 wrote to memory of 4208 1492 svchcst.exe 99 PID 1492 wrote to memory of 4208 1492 svchcst.exe 99 PID 1492 wrote to memory of 4660 1492 svchcst.exe 98 PID 1492 wrote to memory of 4660 1492 svchcst.exe 98 PID 1492 wrote to memory of 4660 1492 svchcst.exe 98 PID 4208 wrote to memory of 4028 4208 WScript.exe 100 PID 4208 wrote to memory of 4028 4208 WScript.exe 100 PID 4208 wrote to memory of 4028 4208 WScript.exe 100 PID 4660 wrote to memory of 2324 4660 WScript.exe 101 PID 4660 wrote to memory of 2324 4660 WScript.exe 101 PID 4660 wrote to memory of 2324 4660 WScript.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe"C:\Users\Admin\AppData\Local\Temp\a5fd7486727cadc047a45cfd8ba25366195eeedc515dee56836e1fd9fdee0517.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
PID:212
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2324
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4028
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 3a2a423d9df888fadef3786fdbf7fb0125eb8e1d08b22a707b6efa4bc00b7f43
- MD5 a66ca64afe431b7c50358bd05ba54e34
- SHA1 f34d905ac06b3c07f936352bff4db70469f5057c
- SHA512 90ea8413b1fce013f8e902e0e3efbbfd1ec30c7f26ca2fb05e390a847d22a1181eeb60dccf6e3f8fec5aeff2568506977ab47018a54d328078ab14407f3eeb09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 054ccb4671ec5693715c290f0bed875878cda62addcb38ef21257c59037fe30a
- MD5 57e51d7e4374cd875109b11b9b8deb29
- SHA1 aa5554bdcf8417f4b5fc9242f1de625e2fb820bf
- SHA512 6f58d52a71466d92d7da68e1bfdd91db03619d810eae2622b4e5623d2ad4e30e294d885c8c5405b775aa3256e3acbd0442a3bb2a4b6eb50001ee5f8848d66da3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 6d2d6a3ac6a4ce5be56fb97a650203a31db169d7f1523de01820b7163b13d27a
- MD5 5f852d0ab2efed28e581d355f2481d09
- SHA1 8c75fa0b197d4479d0cf4a6dacf8453b4b794e5d
- SHA512 9578aa8889c5623edf5f4caa075244b08e4d78fbfc33223e129e69b44d7a1b7b3bd211f5d8e39dc22f535645e6a9bfb23cc9b270f0e0a7d5f907238d34e1af74
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 0255ed50ce86d7a17b4b168af7e5f50fbfc9f2a29b2524cd72fb10ca3c2345d3
- MD5 50acd9d66c97db933b659b92b8fa27b1
- SHA1 ee56f29377f24ecd3bffc77c448025fc37cade78
- SHA512 cf91d696535e8aca48cf6324e8b8aa34cd75d9f294a42f992abf2f041b2ce24258362cb713d716e566213523915995ad6a2a7000e61e8ae5eee1a2a6d622d29c
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QV:CcaClSFlG4ZM7QzMu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 aacc332eee783a214bf1d1490df30c499c767d543e903cd622454e3982c1379a
- MD5 a3361e03dc3e951079023a985e63ae7c
- SHA1 ecd03b5aaf2e7202bc5c0639061d27f454eacf27
- SHA512 5a68764b47758bed4c5bf17cb1991b454b7442cb9c3de22c903bab2c5be69512ae9f2388388b35438b7930236ad6f0fcd645d396259f94659d0a38061e9864c8
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qv:CcaClSFlG4ZM7QzMY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 e32eb76e74e15c80299b4dd1c16ca724f0218bfb941f045dae40ed8da80f1ef8
- MD5 f4ff7db4f22964f3310e4e764e015a0b
- SHA1 354e879d45cf28875c47102078f08b9fece3be93
- SHA512 3c799c9812c4e844fb2b35d30f14b2c4ab042a50299475220f1ec9e99acb59bcdbab7bbc7ac748f7f1df3a73799381cf1ab6cc6d6e63c6c61fd3659264c7deb8
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QU:CcaClSFlG4ZM7QzMT
- MD5 SHA1 SHA512 SSDEEP