Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 07:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe
- Size 1.1MB
- Sample240603-jdkd4ahd34
- SHA256 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667
- MD5 fe3ee022f3cfdca3aae539cadc602f75
- SHA1 72b7c35771b1e62eaf75f5cb9e84ceb075452971
- SHA512 307b567398eeccbace1212e59407e76885f321c30ceb56b743c5f334696deb3d6a237c33cdf7a272f6bac6ff3f75e2b81bf95d5cee18e7cf225de3b915ca91b5
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qg:CcaClSFlG4ZM7QzMX
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 5100 svchcst.exe - Executes dropped EXE 2 IoCs
pid Process 336 svchcst.exe 5100 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe 5100 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 5100 svchcst.exe 5100 svchcst.exe 336 svchcst.exe 336 svchcst.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4488 wrote to memory of 2860 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 83 PID 4488 wrote to memory of 2860 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 83 PID 4488 wrote to memory of 2860 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 83 PID 4488 wrote to memory of 2256 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 84 PID 4488 wrote to memory of 2256 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 84 PID 4488 wrote to memory of 2256 4488 e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe 84 PID 2256 wrote to memory of 336 2256 WScript.exe 94 PID 2256 wrote to memory of 336 2256 WScript.exe 94 PID 2256 wrote to memory of 336 2256 WScript.exe 94 PID 2860 wrote to memory of 5100 2860 WScript.exe 95 PID 2860 wrote to memory of 5100 2860 WScript.exe 95 PID 2860 wrote to memory of 5100 2860 WScript.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe"C:\Users\Admin\AppData\Local\Temp\e3e2439bcaf44e733053011d9df9521ffeb7bf672a4cf9861f099606231a3667.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5100
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:336
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 a55371e62ab91a604898cacdaedc4e508e2fcf27b450682c4161e12a324027f1
- MD5 56a1705a5a8b4e29c38a98fb452d446c
- SHA1 1f576b6db25adec4f3aa873029c4515bdb2a07e9
- SHA512 de1ec85e4ac3c6080a1e2c5b6af42ca1603319410a7084f5e58014e13b8deacd58e8188323b0e5aff128f68001c245311de212b621d5582e6dac673ec9066550
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 dffdd7810a72ae145aa67809e2f09e60c0e7aec2eeab5b3bdd98a446c14294ae
- MD5 5b3af66aeb16fd555f410fc24af0fd74
- SHA1 5071242b3a194e68d495b3028533bbfd05d21930
- SHA512 e1ecc2740d2d07854794fe8dba4dd73de2b199e36deb8406043381b6af951af3592985e6368dd24d8ab2650f6bfc02d4374f3b85e380a7f3886ec5ab4745db86
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qd:CcaClSFlG4ZM7QzM2
- MD5 SHA1 SHA512 SSDEEP