Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 07:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe
- Size 1.1MB
- Sample240603-jc5nmsgb3z
- SHA256 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0
- MD5 f600a3cf6fea73e39be5117ae126e0df
- SHA1 32ca2710c2cb2851f35452ecf3ea25a77a56df54
- SHA512 8248df30541fa5359909d8a701a7f2eeac4dd38b73013f6d475d160b7a2bcd1af15ee868a2fc3fa3f69067a0253b44f85ad3722c8aa99501f25da72d05bc38a3
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QW:CcaClSFlG4ZM7QzMd
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation svchcst.exe - Deletes itself 1 IoCs
pid Process 364 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 364 svchcst.exe 1512 svchcst.exe 4756 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings svchcst.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4404 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe 4404 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe 364 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4404 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4404 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe 4404 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe 364 svchcst.exe 364 svchcst.exe 1512 svchcst.exe 1512 svchcst.exe 4756 svchcst.exe 4756 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4404 wrote to memory of 2884 4404 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe 82 PID 4404 wrote to memory of 2884 4404 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe 82 PID 4404 wrote to memory of 2884 4404 8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe 82 PID 2884 wrote to memory of 364 2884 WScript.exe 91 PID 2884 wrote to memory of 364 2884 WScript.exe 91 PID 2884 wrote to memory of 364 2884 WScript.exe 91 PID 364 wrote to memory of 612 364 svchcst.exe 92 PID 364 wrote to memory of 612 364 svchcst.exe 92 PID 364 wrote to memory of 612 364 svchcst.exe 92 PID 364 wrote to memory of 3856 364 svchcst.exe 93 PID 364 wrote to memory of 3856 364 svchcst.exe 93 PID 364 wrote to memory of 3856 364 svchcst.exe 93 PID 3856 wrote to memory of 1512 3856 WScript.exe 96 PID 3856 wrote to memory of 1512 3856 WScript.exe 96 PID 3856 wrote to memory of 1512 3856 WScript.exe 96 PID 612 wrote to memory of 4756 612 WScript.exe 97 PID 612 wrote to memory of 4756 612 WScript.exe 97 PID 612 wrote to memory of 4756 612 WScript.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe"C:\Users\Admin\AppData\Local\Temp\8a9d8026faeefbeb2b00dbc42e8b9311efe4b923c50e5acf52f06ffc1360d8c0.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4756
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1512
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 58cc8d0ad1f40e9fbfb9ddddcad57a967b01558f0b5ffb61fb23a78bc62ade09
- MD5 a26e7e328dd3ecfe4595db4386bd9f44
- SHA1 b6694f967e460ebbd207c6c22880344de0fd1550
- SHA512 eea87890ad99429d0db31e5942f3c7b7fe0f4bd9847dfad04ca395b1a6ca43dbfdf40166136eda007bfd601bed8423ccd30317a2ac8ee4a1f1efa8c9b9a94fb3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 8d4ff60de30d55f81dda162ccf8ad556e3a1c9a9e20260d8a767def90595191a
- MD5 1931659cf1a0b565c26fde26192e60ea
- SHA1 290204916cf2bd320dd6af5de4fea33f4b987a23
- SHA512 9a90635a350ecaf5d4f9c5787f4079e90d6e2983b87e8dc6db38a2d0121e68422d2fc8c7e322c0b6556cd92870713380edf55950260e9369350e96d4603f390e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 6328d7f137e476aad84d6b92aec341462a0131c670640fb7746c3b0681d6362b
- MD5 59f7834ac472303691686086b9b17c66
- SHA1 bc1ca6019c1f724594dfdd25ec966cfcb1ad950b
- SHA512 e9fdedce7f578c48acfbcec1d6ff218c42fe3c4d10def9906bf2338c3f64f1e1df38fa485f2dc5c707f9bba0d0c6e957d616ebd2b9e47dff042e80af40c63f37
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QM:CcaClSFlG4ZM7QzMr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 12e6ccdfeece28cb27f30b5e9ff4c838b1d396a792e26f43d4b0899bac543218
- MD5 085f2943308a706c9c1280c34c5d4bab
- SHA1 b9fc24e5c7100ad4d17b15e81e77585ab8661024
- SHA512 5eab9653bf492ad778ff3ff110b1bddc51d6fb262bd8eb422211a144164fdcbb45ada9d8117f9e0f054f85e4b663c2246768cf8d06443900dea316f20cc2bd5f
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Q1:CcaClSFlG4ZM7QzMO
- MD5 SHA1 SHA512 SSDEEP