Overview

overview

7

Static

static

3

b2e9de5d72...5d.exe

windows7-x64

7

b2e9de5d72...5d.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 18:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2e9de5d7261c969e775410f89c5e60bcdf655f6fbf4e2a672c84b2938141c5d.exe

  • Size

    1.1MB

  • MD5

    99130099fcae6f94ef50318ae0475f1a

  • SHA1

    a08039f3dab482b2ce679836ceebbc8b59923b30

  • SHA256

    b2e9de5d7261c969e775410f89c5e60bcdf655f6fbf4e2a672c84b2938141c5d

  • SHA512

    2d6a0f32c5db78d4830e754bb115302a02ba388948750181816f2098a8422f8f7ba4b5c2f83bfae38d768bf6ee032f3235265380a7cfe288de18ab5a885443db

  • SSDEEP

    24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qh:acallSllG4ZM7QzMS

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 10 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2e9de5d7261c969e775410f89c5e60bcdf655f6fbf4e2a672c84b2938141c5d.exe
    "C:\Users\Admin\AppData\Local\Temp\b2e9de5d7261c969e775410f89c5e60bcdf655f6fbf4e2a672c84b2938141c5d.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
        PID:5012
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        2⤵
          PID:2608
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          2⤵
          • Checks computer location settings
          • Modifies registry class
          PID:1984
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          2⤵
          • Checks computer location settings
          • Modifies registry class
          PID:3652
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          2⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1188
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3312
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          2⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:708
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
            3⤵
            • Deletes itself
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:4468
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          2⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4524
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4704
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          2⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2460
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3392
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          2⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:760
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1992
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          2⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1008
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3288
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          2⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1136
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2084
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:2084

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
          Filesize

          753B

          MD5

          69238bac1a4b65b4797b4880ec6ca735

          SHA1

          f88fc57900122911d0a66a566e55049c91f42400

          SHA256

          82acc15df8b63ff3f70f64576f75d16f4150234dab8227f7e6b41f3d195cfabb

          SHA512

          c8d1b54fc2afafc8478d6cee727a6969235a542c5745d1518ac7ef09c650765787a09cf2fb20b864e690b0faad5f9691479a8c50484b02088a760f6d866a99eb

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
          Filesize

          1.1MB

          MD5

          52abc1f2ba0629ebba79d8d8aa3deb12

          SHA1

          79fb46be4d853c67306bc0efa398c094f6ced838

          SHA256

          5764d45bc8ac35aecf56d4544fb2c04b497fe0b58d9feef74d88192da37116ad

          SHA512

          6cc647e43d294dfb594a36e929aa1d767934e2c16c561fa40ea520606f3545f5c3757df511ce428ac283081097eaaf29c2dbe4efd177a0503087cf7015b369e9

          Download Submit

        • memory/1804-0-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/1804-29-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/1804-30-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/1992-39-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/1992-43-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/2084-38-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/3288-34-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/3312-46-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/3392-45-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/3392-48-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/4468-49-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/4704-47-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/4704-42-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

          Download