Analysis
- max time kernel
51s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe
- Size 1.1MB
- Sample240613-eac4dstamh
- SHA256 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048
- MD5 eea2c4b02e0386c3f9f6ee472558b629
- SHA1 8b57073c6111211b6928a476559ef026441f8fdb
- SHA512 bf110b71b67ebc2bb6afc56c7dee58b082f45c43d08093ff80ae131e6e4da2fff8b5dbd1c5b7498b8e29cb6df6cdb5892b2d02f18863e92041fed4ecb0254bd6
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QP:acallSllG4ZM7QzMI
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 2464 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 2464 svchcst.exe 2924 svchcst.exe 4972 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 960 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe 960 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe 2464 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 960 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 960 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe 960 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe 2464 svchcst.exe 2464 svchcst.exe 2924 svchcst.exe 2924 svchcst.exe 4972 svchcst.exe 4972 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 960 wrote to memory of 3872 960 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe 83 PID 960 wrote to memory of 3872 960 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe 83 PID 960 wrote to memory of 3872 960 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe 83 PID 3872 wrote to memory of 2464 3872 WScript.exe 87 PID 3872 wrote to memory of 2464 3872 WScript.exe 87 PID 3872 wrote to memory of 2464 3872 WScript.exe 87 PID 2464 wrote to memory of 2432 2464 svchcst.exe 88 PID 2464 wrote to memory of 2432 2464 svchcst.exe 88 PID 2464 wrote to memory of 2432 2464 svchcst.exe 88 PID 2464 wrote to memory of 608 2464 svchcst.exe 89 PID 2464 wrote to memory of 608 2464 svchcst.exe 89 PID 2464 wrote to memory of 608 2464 svchcst.exe 89 PID 2432 wrote to memory of 2924 2432 WScript.exe 91 PID 2432 wrote to memory of 2924 2432 WScript.exe 91 PID 2432 wrote to memory of 2924 2432 WScript.exe 91 PID 608 wrote to memory of 4972 608 WScript.exe 90 PID 608 wrote to memory of 4972 608 WScript.exe 90 PID 608 wrote to memory of 4972 608 WScript.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe"C:\Users\Admin\AppData\Local\Temp\405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4972
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 7bf3fbb9962c054e651caf4e49fa468d5892cb0bf88f4bbf3fd85b372a7d173c
- MD5 16b9011648a577741b7fb4a55f1eeaac
- SHA1 b0d86d1cf62b882bf28f0897ddb610e41cc6814c
- SHA512 1d8631904aa2df5a90aef858d4369ed53d0075f97b42361a8e05c9a64f8e6a786897b625b1230d20415f3923db8aa5d8f5f619b7b9084202fecf4e7cead4366d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 d90022d9aa0ec2515e0f548392d48fd2364c79d2b54b40b94378e18c591b0ec7
- MD5 be719776c8edd5386712fc04b9ac1a27
- SHA1 bd30a65ce39bfb71e63da662189a6ae9693664f6
- SHA512 25d3a35d96e14a478012a9862d633c6af192fdd43fe4a0920b834a170eb4e57b2a3a05a530f6fb43a9d6509d95f919e405c33d8c867bd152e0c2b7842966b7c8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 09914c7c6515ff16d0408da41ffcd4634421789c0cf264038848c8ee725aef2e
- MD5 9f5a739ad1fdc50270e27b3a58ab2d68
- SHA1 cc2f862f5e115c6eeba74abfe68ac42b9065b2cd
- SHA512 069643a7306e2f3a2aa0a5b535a492bb868a7770679f2da65b05dd403e0b41924f0b96911406379b9534065be4eeaf47cbe088aeac7cda9a68fcff25708efd8a
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Ql:acallSllG4ZM7QzM+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 45f048f483f926a320f28b65efc49904176a57e05ebb09d1ac32bfb5c5a8e530
- MD5 413c575f4116fb9e7d65e7d4bfe4061d
- SHA1 ba10ee3dd7058488b6f6307d55105d15b196e2ae
- SHA512 3c144c89e24450804286e705e1870647f1e264965ca1ecd79769347be36b5dc046ef91aae708d9ca4cada2eeeff8a04bdcf592efe86382106e0edbbb9b177a0c
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qd:acallSllG4ZM7QzMm
- MD5 SHA1 SHA512 SSDEEP