Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
06/06/2024, 21:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe
- Size 1.1MB
- Sample240606-1b76tadd55
- SHA256 c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b
- MD5 f1613c170a394caaedaf41739db21e8b
- SHA1 ec0d866bac44daa3eb4a5c8917ddd4957229766c
- SHA512 9c54063466adcee6e63bbe51562eeab9b94933deee929913eec41c0a5979f10cdfe06cb20d15aafe47c1963181db6d6f560a989c2c8e3e10b97440e5286e3e05
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qb:acallSllG4ZM7QzM8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 432 svchcst.exe - Executes dropped EXE 5 IoCs
pid Process 432 svchcst.exe 4532 svchcst.exe 3872 svchcst.exe 928 svchcst.exe 4248 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3480 c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe 3480 c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe 432 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3480 c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3480 c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe 3480 c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe 432 svchcst.exe 432 svchcst.exe 4532 svchcst.exe 4532 svchcst.exe 3872 svchcst.exe 3872 svchcst.exe 928 svchcst.exe 928 svchcst.exe 4248 svchcst.exe 4248 svchcst.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3480 wrote to memory of 4932 3480 c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe 83 PID 3480 wrote to memory of 4932 3480 c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe 83 PID 3480 wrote to memory of 4932 3480 c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe 83 PID 4932 wrote to memory of 432 4932 WScript.exe 95 PID 4932 wrote to memory of 432 4932 WScript.exe 95 PID 4932 wrote to memory of 432 4932 WScript.exe 95 PID 432 wrote to memory of 2520 432 svchcst.exe 96 PID 432 wrote to memory of 2520 432 svchcst.exe 96 PID 432 wrote to memory of 2520 432 svchcst.exe 96 PID 432 wrote to memory of 4016 432 svchcst.exe 97 PID 432 wrote to memory of 4016 432 svchcst.exe 97 PID 432 wrote to memory of 4016 432 svchcst.exe 97 PID 4016 wrote to memory of 4532 4016 WScript.exe 100 PID 4016 wrote to memory of 4532 4016 WScript.exe 100 PID 4016 wrote to memory of 4532 4016 WScript.exe 100 PID 4532 wrote to memory of 4660 4532 svchcst.exe 101 PID 4532 wrote to memory of 4660 4532 svchcst.exe 101 PID 4532 wrote to memory of 4660 4532 svchcst.exe 101 PID 4660 wrote to memory of 3872 4660 WScript.exe 102 PID 4660 wrote to memory of 3872 4660 WScript.exe 102 PID 4660 wrote to memory of 3872 4660 WScript.exe 102 PID 3872 wrote to memory of 3788 3872 svchcst.exe 103 PID 3872 wrote to memory of 3788 3872 svchcst.exe 103 PID 3872 wrote to memory of 3788 3872 svchcst.exe 103 PID 3872 wrote to memory of 1880 3872 svchcst.exe 104 PID 3872 wrote to memory of 1880 3872 svchcst.exe 104 PID 3872 wrote to memory of 1880 3872 svchcst.exe 104 PID 3788 wrote to memory of 928 3788 WScript.exe 105 PID 3788 wrote to memory of 928 3788 WScript.exe 105 PID 3788 wrote to memory of 928 3788 WScript.exe 105 PID 1880 wrote to memory of 4248 1880 WScript.exe 106 PID 1880 wrote to memory of 4248 1880 WScript.exe 106 PID 1880 wrote to memory of 4248 1880 WScript.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe"C:\Users\Admin\AppData\Local\Temp\c2c6f2b38f69e00aabfdaddf9ccc3122361c5128d4f288c0031ebf1e6805f54b.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵PID:2520
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:928
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4248
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 0d0a8daeceed64600e817a5a0437a39048c52e857868a35d9130d42fdfa896ed
- MD5 072a46f071251f08c67b3aba4c983435
- SHA1 371837f885eac20c802901026d2e7aa1d4f6cd5c
- SHA512 e3d35d428a29eec047b0cc43c87aa701eed81e9efe921b4ef13fa2e8e24ef11ce602bd67868b7ad1bdbd9f39eb681a8c95c715479238a2f17c17105ea4653c83
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 fcc9bbb778bd89346d294cde7f942f5b7d95ec69f7e42c3d00ac219f80d7f4e2
- MD5 724f6374d1c7ac1633a6ccc5629d6fc5
- SHA1 55d49f9bef8106292e9c5d60e66544a70c1451c3
- SHA512 119282f908c6d749736568ab427ca26a7262100c52d35f3d703c96f5dfca6dfce47d17395cd171de2aca622d503bea08a746f9ff35bcc11d7e3bd2c253687cfd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 4382e8d6fd98aeb7c574b195019c1687ac6628e8f97485614ad743ae5a0616b0
- MD5 02bec440e11bdc76b5de3232abd91f03
- SHA1 2118a1f2249848ea084c7d98709f7ba7906e43a3
- SHA512 f86e900e6bd38151fad12b160c0489823bd18d15609346172ca1f815593e69f9269cb28a0eaea6a588a29d41343f3b9d4c6489cc3c50e2b24a31720de26e0411
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 4b2d44fd28dcc86d4f73784cea9ac601d2e69574ea0fc6214b3481b10687e0e2
- MD5 a4e2d4727487955ad59bf2d1a6661981
- SHA1 e52949b5d7226aaf75d3713ed2ff1283edab2259
- SHA512 f3c59196a57237caa7ad762e2e31bb3b95156eb33cdad7d7b28244842a733160a74c6568452252ce2add95980fe653dc5322a3d1722f9d798289557351b5ea55
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 3ffeecf3e7368f25d1e2f7823cdc863e2471b27ea60d59b3beff4812e5d8ff8a
- MD5 0e86c8f23549c13873a764e066570d00
- SHA1 1b64951cbefbe3b37e82354d10b835fc718260dc
- SHA512 eb8fe803c3751e2467d38d44655c67af7ee3dea0a43621812f3077d5acc9dc0338c3378c9de32b9066cfe50ce58b3caf6c60d3d8b9aadd5a2dcfe9717f8687d6
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QX:acallSllG4ZM7QzMQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 827fb11874e4efa6e4ff0b0b8e2e654998442b76eb20f86bf604e1de44411b51
- MD5 43a5c7b5120ab84d8a88a0b8f8eba690
- SHA1 6f95cdd09b0711d70008db4e248c60babeec648c
- SHA512 53cb71cb3114250293d727dd33aaa0483a80f3925af661b8faa8a721d2aae40fc215b36b3cdb1115a51a037375bbc423b31723d83b1e86a3fd468c71f6a66afc
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q+:acallSllG4ZM7QzMl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 e7bc36af528f7acd082a1aabb69ccf7e2a09441859f469c74eb7edcef8a1393d
- MD5 1fbe183d1bf204384ca9786eff6f616f
- SHA1 4b7d424182c1dc29cc16d1264acf8059d7c7a3f8
- SHA512 21b6a39f6e033fe5ae57b3120ad6e85d8ec7c64a3721ba82122c7248a9794629fd51aad66e7699449a06c9649b029f82f81ceab7e3cc2f7608c024cdbf1f4b4e
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QT:acallSllG4ZM7QzMU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 fda221fc0749bc1ac0469683c2fa7111692bb7797498adc9fb5dd1114d7bbd84
- MD5 daf5c79b7b3140e30f325d6058d98e5d
- SHA1 b6b10dc3b5c2ebc74e79c34bee0ffebf078ac040
- SHA512 5e2c1d3ae0ab2131fd2f39022f377fa9e009b91ca72334e25fe6acf3e5e2b61a63e61264e80ec516e4dc1b45796e2c692658d63ebed59dcdab0a062622afd529
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QG:acallSllG4ZM7QzM9
- MD5 SHA1 SHA512 SSDEEP