Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe
Resource
win10v2004-20240426-en
General
-
Target
fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe
-
Size
1.1MB
-
MD5
ccd80a68f925feaffe7ddc5d94645f4d
-
SHA1
e775cb59c7b38446a7272c2aed315ebb69b38cd7
-
SHA256
fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116
-
SHA512
0488992c6fd9aee18e661ee40304104975b409bf48610513331110340a042b92a5672527e9ae6f55ce1b4e7ebf570e520ee8edb3b0ab7b9f06208aca85962f42
-
SSDEEP
24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qa:CcaClSFlG4ZM7QzMZ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation svchcst.exe -
Deletes itself 1 IoCs
pid Process 1672 svchcst.exe -
Executes dropped EXE 4 IoCs
pid Process 1672 svchcst.exe 3184 svchcst.exe 3920 svchcst.exe 2948 svchcst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings svchcst.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3512 fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe 3512 fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe 1672 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3512 fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3512 fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe 3512 fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe 1672 svchcst.exe 1672 svchcst.exe 3184 svchcst.exe 3184 svchcst.exe 2948 svchcst.exe 2948 svchcst.exe 3920 svchcst.exe 3920 svchcst.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3512 wrote to memory of 1556 3512 fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe 82 PID 3512 wrote to memory of 1556 3512 fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe 82 PID 3512 wrote to memory of 1556 3512 fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe 82 PID 1556 wrote to memory of 1672 1556 WScript.exe 91 PID 1556 wrote to memory of 1672 1556 WScript.exe 91 PID 1556 wrote to memory of 1672 1556 WScript.exe 91 PID 1672 wrote to memory of 3028 1672 svchcst.exe 92 PID 1672 wrote to memory of 3028 1672 svchcst.exe 92 PID 1672 wrote to memory of 3028 1672 svchcst.exe 92 PID 1672 wrote to memory of 4064 1672 svchcst.exe 93 PID 1672 wrote to memory of 4064 1672 svchcst.exe 93 PID 1672 wrote to memory of 4064 1672 svchcst.exe 93 PID 4064 wrote to memory of 3184 4064 WScript.exe 96 PID 4064 wrote to memory of 3184 4064 WScript.exe 96 PID 4064 wrote to memory of 3184 4064 WScript.exe 96 PID 3184 wrote to memory of 4564 3184 svchcst.exe 97 PID 3184 wrote to memory of 4564 3184 svchcst.exe 97 PID 3184 wrote to memory of 4564 3184 svchcst.exe 97 PID 3184 wrote to memory of 1920 3184 svchcst.exe 98 PID 3184 wrote to memory of 1920 3184 svchcst.exe 98 PID 3184 wrote to memory of 1920 3184 svchcst.exe 98 PID 1920 wrote to memory of 3920 1920 WScript.exe 99 PID 1920 wrote to memory of 3920 1920 WScript.exe 99 PID 1920 wrote to memory of 3920 1920 WScript.exe 99 PID 4564 wrote to memory of 2948 4564 WScript.exe 100 PID 4564 wrote to memory of 2948 4564 WScript.exe 100 PID 4564 wrote to memory of 2948 4564 WScript.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe"C:\Users\Admin\AppData\Local\Temp\fa3b25234d5581de6992d67d5389a63e654c8a8e09a1ba32680ad023f91c6116.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵PID:3028
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2948
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3920
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD567b9b3e2ded7086f393ebbc36c5e7bca
SHA1e6299d0450b9a92a18cc23b5704a2b475652c790
SHA25644063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
SHA512826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
-
Filesize
753B
MD5a71314f6cd3277777af5485b00c8233a
SHA12dcf01a4c964893ad9d4cfcf91ddf2d8b33e1cff
SHA25681bd99047608286b1322351b397dd38238cf07fb3c1149192fb83b03d470e967
SHA5122d9270c477b8d152b54ea0a7837c5dfc0292aca1ab25929ac54fd8354ef70deb0a428ea5f2f0f0ddeac5387480f4431ea772208640115a45cf18823bcfee1195
-
Filesize
696B
MD598328aa8ad181fbf0b87edfc21155dce
SHA13ca100ca64d5f62a5dceef47f414c0953fd4f559
SHA256a6928cf27564f6f983d8f62358463a2dee471715b220de03db8b72ebf105f20c
SHA51275f298c982eeebf184fdd0612436583a863beba740bd55053539dc1b1c20103a1c6f5da46b41621eb00d601cdfc86c1705080a0da08fef7756637805dcb588ec
-
Filesize
696B
MD5c1f667683c1809dc2fa81d863ea10a4e
SHA1dc9fdbeca32f2afbcfdc5363769ebb594fc93e44
SHA256a0afd04975f7f5cf26533640020a9533d4dcf1b152143e69196f93bd5b49fa1e
SHA512e4c894530934444cb97392b0180e5b6040b84ab5c639412c6b9e5355a13152412da8d881403832c2f3c601624465b16242ebd8710f6e6a4666a27e15ce759b2f
-
Filesize
1.1MB
MD5b2a132b062db9a2f29a9509dfdda0b2c
SHA1a3119506c4f9d695e01f5c43bc85d62faa09bf82
SHA256ff277d4d4c954b5de62c3b2df825f54190262a900c4b24100b8742ba56119163
SHA51293d2cbae1bc9e26a1b5d0c22f49471076b18e1782a2db8857f7a1ed082f386a4aedaecf7885577b0989bc2dd2118271a98943da970497915cc23dcca5e340ad2
-
Filesize
1.1MB
MD5292386eb35e74303581921f354f06d2c
SHA134ef79141febba916837a652c9a4446e01ee112f
SHA256c2063d0492c86f89b3a6832b772c72f43ccdf3fbe3684d4e3005c0062583446b
SHA5125211ec2bb701695b4336cb57a2fb63d7f7468eccd041e044aad9b24547c9a4d7c1c9580cf640dbfe817faab3c7981ac4a16c2a714cb3f0f9cabd905e1228ab2d
-
Filesize
1.1MB
MD528f534a5d7a58c9bc521d19ec4a964fb
SHA1f4c7a1a4350df28a640408c78c33619df44c089a
SHA2568ff64812f78cfd9ce0f68e46d2d6c9c518caa9042f1f4607d0bd60cc54c817e0
SHA512c5b587e1d1ab722f0c6aa49cc5aa10d53545f42e7578976b60664c3304bc2112c6dcff3a20d3aa0fd6bf7f808c46830f19ecf8d6e8e5831a60b093271b134798