Analysis
- max time kernel
92s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe
- Size 1.1MB
- Sample240613-c4czda1fpf
- SHA256 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511
- MD5 a4ad0f6ff89224ed7a8aebe7a311ac81
- SHA1 99e75413eb19eebc142eb6537e583060b6cdf044
- SHA512 7836eb21cbe543119b15d210fc323b92a97ee0a2eea01af052b9300a7a818fd47afbf9b8daf35b2d396630fea37a8031a9ded4242bf5868cac328114bdac0d0d
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qm:acallSllG4ZM7QzMN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 5064 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 5064 svchcst.exe 4388 svchcst.exe 3652 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe 2472 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe 5064 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2472 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2472 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe 2472 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe 5064 svchcst.exe 5064 svchcst.exe 4388 svchcst.exe 4388 svchcst.exe 3652 svchcst.exe 3652 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2472 wrote to memory of 876 2472 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe 85 PID 2472 wrote to memory of 876 2472 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe 85 PID 2472 wrote to memory of 876 2472 4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe 85 PID 876 wrote to memory of 5064 876 WScript.exe 92 PID 876 wrote to memory of 5064 876 WScript.exe 92 PID 876 wrote to memory of 5064 876 WScript.exe 92 PID 5064 wrote to memory of 3068 5064 svchcst.exe 93 PID 5064 wrote to memory of 3068 5064 svchcst.exe 93 PID 5064 wrote to memory of 3068 5064 svchcst.exe 93 PID 5064 wrote to memory of 4608 5064 svchcst.exe 94 PID 5064 wrote to memory of 4608 5064 svchcst.exe 94 PID 5064 wrote to memory of 4608 5064 svchcst.exe 94 PID 3068 wrote to memory of 4388 3068 WScript.exe 95 PID 3068 wrote to memory of 4388 3068 WScript.exe 95 PID 3068 wrote to memory of 4388 3068 WScript.exe 95 PID 4608 wrote to memory of 3652 4608 WScript.exe 96 PID 4608 wrote to memory of 3652 4608 WScript.exe 96 PID 4608 wrote to memory of 3652 4608 WScript.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe"C:\Users\Admin\AppData\Local\Temp\4eb04f313376aa3a4381fbbf6e26d8b648014e8404c90bab144372a2db671511.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4388
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3652
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 d1cc28af2f0b20413ec447f1a0181fdf4ce200bf32f8aada6bdae2a86f23bc4b
- MD5 3c63fa8095795923810a19852a2a74c9
- SHA1 ef6d07eacec8bff8d5b3e8dc37b7a50cbaaf3c26
- SHA512 0fd71ae224715133106acecceefecc95ed5b2799fc8c9e214b2e87b37b7c2fdcdb201f7865634de2b68750882c65ce897e556a078b5c5bae0be8d09b9081fe0f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 0d5abb9f989e8b184b17b159987cacb4be04d476a85a3c684e797cdbded810cb
- MD5 321085c6e57a8455a3e915906a6c160b
- SHA1 9cd284183cd00b8ed9766cf5ba4433bd041c381e
- SHA512 030c762c6548c28805fb3f9d97ed98ff958a379fb5142b7ba6c4cb2a8dd7a59051135e649abd6c16320361b10c374e4a1003c802560fcc244849089255fb7722
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 4c00f9364d4ddce8193e5804cf7b0232f2675eb47397f944ff1eb096dc9dd037
- MD5 a6b23f303700c453e405ed3fc41b9f43
- SHA1 11c27c4fcdb2ac9887637ca51c05518acad1d97c
- SHA512 4755419cc6913017fc09822b18c5b9cdcbd0e46df57cf0f1f6c82a566201a68c147a17326b195c95ceac4c3b85c7033ce81ae9dfd447ca3c7c21aa6c17143c7e
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QI:acallSllG4ZM7QzMv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 4a8cccd634a0747b78a44dfd6c7da9fd3fe815188ffa8a3fb2c1adb6a6e8f06e
- MD5 7486d140917f454f978c5c753ed1cd2c
- SHA1 808b0502a9c04f1695a770e7a46f22dbf75a726f
- SHA512 cad96030ee4afcb7d1ffa231dfbb134a3a7e9986ed5df905d41e06a70ffc32c8d1c88a2c8b4e0102d130e806f3eca32562a13a766534639dce1ae8115467a370
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QM:acallSllG4ZM7QzML
- MD5 SHA1 SHA512 SSDEEP