Analysis
- max time kernel
132s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe
- Size 1.1MB
- Sample240603-mnfqfacg59
- SHA256 c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead
- MD5 83c23846d3b56e8d7ddbac67bb1c4bb3
- SHA1 1267753bc80a8edbf7595c9197b2c8a79eda03ea
- SHA512 64f2c41b2ffc0123004827374882a1053ece97699d8db028e1595dbd80ee70c5098e96cecdfc9f500400b278e7069e6dc22f4386367e531cb04db19151d1dc0b
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q+:acallSllG4ZM7QzM1
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 3052 svchcst.exe - Executes dropped EXE 5 IoCs
pid Process 3052 svchcst.exe 964 svchcst.exe 3024 svchcst.exe 900 svchcst.exe 2556 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings svchcst.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2308 c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe 2308 c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe 3052 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2308 c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2308 c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe 2308 c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe 3052 svchcst.exe 3052 svchcst.exe 964 svchcst.exe 964 svchcst.exe 3024 svchcst.exe 3024 svchcst.exe 900 svchcst.exe 900 svchcst.exe 2556 svchcst.exe 2556 svchcst.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2308 wrote to memory of 4944 2308 c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe 90 PID 2308 wrote to memory of 4944 2308 c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe 90 PID 2308 wrote to memory of 4944 2308 c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe 90 PID 4944 wrote to memory of 3052 4944 WScript.exe 103 PID 4944 wrote to memory of 3052 4944 WScript.exe 103 PID 4944 wrote to memory of 3052 4944 WScript.exe 103 PID 3052 wrote to memory of 3296 3052 svchcst.exe 106 PID 3052 wrote to memory of 3296 3052 svchcst.exe 106 PID 3052 wrote to memory of 3296 3052 svchcst.exe 106 PID 3296 wrote to memory of 964 3296 WScript.exe 107 PID 3296 wrote to memory of 964 3296 WScript.exe 107 PID 3296 wrote to memory of 964 3296 WScript.exe 107 PID 964 wrote to memory of 2932 964 svchcst.exe 108 PID 964 wrote to memory of 2932 964 svchcst.exe 108 PID 964 wrote to memory of 2932 964 svchcst.exe 108 PID 964 wrote to memory of 4608 964 svchcst.exe 109 PID 964 wrote to memory of 4608 964 svchcst.exe 109 PID 964 wrote to memory of 4608 964 svchcst.exe 109 PID 4608 wrote to memory of 3024 4608 WScript.exe 110 PID 4608 wrote to memory of 3024 4608 WScript.exe 110 PID 4608 wrote to memory of 3024 4608 WScript.exe 110 PID 3024 wrote to memory of 1556 3024 svchcst.exe 112 PID 3024 wrote to memory of 1556 3024 svchcst.exe 112 PID 3024 wrote to memory of 1556 3024 svchcst.exe 112 PID 3024 wrote to memory of 3740 3024 svchcst.exe 111 PID 3024 wrote to memory of 3740 3024 svchcst.exe 111 PID 3024 wrote to memory of 3740 3024 svchcst.exe 111 PID 1556 wrote to memory of 900 1556 WScript.exe 113 PID 1556 wrote to memory of 900 1556 WScript.exe 113 PID 1556 wrote to memory of 900 1556 WScript.exe 113 PID 3740 wrote to memory of 2556 3740 WScript.exe 114 PID 3740 wrote to memory of 2556 3740 WScript.exe 114 PID 3740 wrote to memory of 2556 3740 WScript.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe"C:\Users\Admin\AppData\Local\Temp\c3b6d65f525cdd2c4cb62e75391dfce86159faaa10809da0691a3f8712eccead.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Checks computer location settings
- Modifies registry class
PID:2932
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2556
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4216,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:81⤵PID:1172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 6d8f49c58b01532005bc795d3a8ebe7ca7da225f824288ff59e48ec634514b0e
- MD5 d4fb581c10788b282b9e02f141dedf27
- SHA1 4ffceee6c744796b3d000b4bb65284ba20dd45bb
- SHA512 ebbf722f8e3c06c67687295b70c408bf7abb01e9f174c97d73ec7f16f42b2ea7b4eaae9308d7643bc9cf7361c0ec0e5ea6ad14c2af62399ab93854a7ac13715f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 643f8c0adfd63b72f9419f5b077829fa7f6d454b738cbcaeead63cd1feb4a9af
- MD5 052d0351a5a2283ca385805bf30cc37b
- SHA1 0f86c2c33b5641b89bcc430a98956447cb8f6f06
- SHA512 6e4f1c407fa96a3ed03b416fcf4cb300f7ecefd2e67ddc0d45407b0f97f254ffa55cf34fac7c8ed1e69ece8704fae1d483612948dab8fb6d0c9d39e06bbb23ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 3488c64a6d2da3c00e50e954c495ac354ee504e54f3ed6dda6a991c5b9d33e19
- MD5 dabf4e9d32908d961aaffdd1c77d4879
- SHA1 e41572d98b7452016fb004c843236377364ab1d3
- SHA512 911d46aca8005857c86eddbb3cbbc4301ee5e173b2358a717053cf12727c06cc3b2d757ddf513f969dafe61c6b88d03b1478d8c483495f153e30bf64585195aa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 f08a191ea7850c2d2e0fa0cd1f40254eecb8dcb63a9dfa94cc8a97f609c49293
- MD5 85fa416be0b995c6e53ce5e2df106d8a
- SHA1 bcffe6d0eb7594897fb6c1c1e6e409bacd04f009
- SHA512 5d92938d833d0555e94027148d0d9fc064274885bb4992f4e5840e7be03b629a3d2dc3703f9a7aa7614cb46ee19f9cfe26c69cc2e3a162f4be9045e5da18efbf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 e550f23e66b68bdc79b29c9e730b0b321d1264bf1ea6b828226c1e239c808e91
- MD5 8c6876c53decbd35b07a178aeddd5289
- SHA1 5b986777efa93571a0dcd179c9112d166f907fe9
- SHA512 7472627fccf14781843f683a100eaf92daea73f0158da58636125dec7a350f9492282aea97d5a961025fb6fe8d2a85d6cb256d0c77772fa227b7e7cdb3742ebd
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QI:acallSllG4ZM7QzMv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 62781249fc43185e6d766d9290a64f31b36d92ee4fa4fca2edb95842c13210dc
- MD5 09de4a86cd2656b5a81ed03475b773c9
- SHA1 ab490da6b390b0ce83c3bb9bd77beb78d726c026
- SHA512 4a949df75ea59c5f738b69731095b0ca995935b245075dcd1dac8d74b43d984aaa9cebd3278eada7cbe969e0a7b71bfbc5bdd9e482d280336620971df89ddbbb
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qk:acallSllG4ZM7QzMj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 a6192e25559ae9b3f1633b424877070124181d1e69ef950e90f00cedefec1de6
- MD5 5691587dfbac92feb4a5a9df404291f8
- SHA1 832ee7321b36d18c7eb2850f1fd10e3a2b9303aa
- SHA512 9b7fb525461a1cc989925977c344dc01457c3948c4dcbc7ebf6f09b146da633e69e1c6e19531d90949b78884cc764acf4611679badc8835f60ba64489b2f8bc2
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QM:acallSllG4ZM7QzMr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 8b7e1119e804f696d2d3f2929a890b8c457d8bd9e3ef38140c8c2f44380dba7a
- MD5 b0a364b8c8883a96675d38df69be4852
- SHA1 27ab05c8c74b53d186c133a9ca5bcad55b12c152
- SHA512 84353f81ea6dd94ed4e54528006e8b95b73451068db7358fbdf50b256550a6eccf6b54698a19794a5f4a01046f05703454ca278438b6902536f00a1c273e315d
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qk:acallSllG4ZM7QzMT
- MD5 SHA1 SHA512 SSDEEP