Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe
- Size 1.1MB
- Sample240603-mlk75sbd7w
- SHA256 f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3
- MD5 c4d0a11663f7c6bbdb38f410a00e8d5d
- SHA1 b0cfd1e11b731ac109f556b63dafb3c0a21ed59f
- SHA512 55b5c2ee6926b8201ef369b18f5c7d428321c629fa5ead053af31b68c2b5bf87a8cf0853f1d11cf7f287501a0b3db2e71bd350f52793d2b0184a62daf9a92898
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qm:acallSllG4ZM7QzMN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 4984 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 4984 svchcst.exe 2644 svchcst.exe 4656 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4228 f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe 4228 f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe 4984 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4228 f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4228 f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe 4228 f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe 4984 svchcst.exe 4984 svchcst.exe 2644 svchcst.exe 2644 svchcst.exe 4656 svchcst.exe 4656 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4228 wrote to memory of 4468 4228 f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe 83 PID 4228 wrote to memory of 4468 4228 f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe 83 PID 4228 wrote to memory of 4468 4228 f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe 83 PID 4468 wrote to memory of 4984 4468 WScript.exe 95 PID 4468 wrote to memory of 4984 4468 WScript.exe 95 PID 4468 wrote to memory of 4984 4468 WScript.exe 95 PID 4984 wrote to memory of 3856 4984 svchcst.exe 96 PID 4984 wrote to memory of 4364 4984 svchcst.exe 97 PID 4984 wrote to memory of 4364 4984 svchcst.exe 97 PID 4984 wrote to memory of 4364 4984 svchcst.exe 97 PID 4984 wrote to memory of 3856 4984 svchcst.exe 96 PID 4984 wrote to memory of 3856 4984 svchcst.exe 96 PID 4364 wrote to memory of 2644 4364 WScript.exe 100 PID 4364 wrote to memory of 2644 4364 WScript.exe 100 PID 4364 wrote to memory of 2644 4364 WScript.exe 100 PID 3856 wrote to memory of 4656 3856 WScript.exe 101 PID 3856 wrote to memory of 4656 3856 WScript.exe 101 PID 3856 wrote to memory of 4656 3856 WScript.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe"C:\Users\Admin\AppData\Local\Temp\f0a73038fff1f222ce375cc1658f88774c5c11f72c1c4ba8f0e06505d706e4c3.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4656
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2644
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 44358f1aedf540acf9e56069e4cc6d4e6a2445ccba362dad9ec4e2f59e0178ab
- MD5 cd34ba54e0dd84bc94990092afc183a9
- SHA1 938feedabe63e3e7c6cbb6a405512e21a7ebe449
- SHA512 1c261ac13591d4d1cd3692dae12de7fb393134b014dbc766b2946b6ea983e74cef7984bb7003241d5221dea9df78e5f5fe31a839ad7d8453a79db887c8d09958
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 9823867be0dbd898a5e241c3672307556d874a44192507f374a2c8a384447d7b
- MD5 3efc63e3507c4074450c9aa86e73fd64
- SHA1 a449831726f40d8bebe6bccbfc26d2d2ea27e4d4
- SHA512 4e600eda8990d65354d9417a4d8ebbef7c65835c2fbbf1eaede4bbd0c3c82d6ca17a799e79fd78b9747f30a22a7062a4e1050a5abe139a35cc7285b15762e623
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 56d68b983f52c9d16397e39547a508d6dd553bae54c8270fb6c1b59497fe5e94
- MD5 870be97b907127bb83876efd2ad11e2f
- SHA1 ea5ef15d65752fbe3ab2196ac50eef3d62c5f8b1
- SHA512 75f548872f1f1bb238d0a83f754ecced51327560ea26352d861188e729535e262af59dacc67f18603afa2cdb14697975c9a8e3e796bec57ce437ac6e4d4e6c67
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QB:acallSllG4ZM7QzMy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 d369c2e056daabd0e12d0ac1eca1d31e500ad56eb55e6dc441278d6dd0fd1ae5
- MD5 b08db48786672cad5558b328bef8d6b4
- SHA1 af8dcbd0f0dd9926ad65711066ca8f02e5051a8b
- SHA512 62df6b47113e15fc836ee55f727a514004b8988ece84ffd5eb150e4f2911cdc043899f655187215c42e6ab6c37f78b186f959d7118a0bc67b080552cc6c1ae2e
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Ql:acallSllG4ZM7QzMO
- MD5 SHA1 SHA512 SSDEEP