Analysis
- max time kernel
125s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe
- Size 1.1MB
- Sample240613-fdaccavcla
- SHA256 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118
- MD5 f733e07275e07200976007c739463689
- SHA1 fcd561184db10125a6bafd7b7933563244bab36a
- SHA512 de95531d5956c1a5fc5520e1e2c746efa0f8ce6fcbcaf5e8aef38b45e8127bab3e864833d2ac211c74fe6673cdcf286da47cc25a30dae1e73ad6ab2b2c8d7307
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QQ:CcaClSFlG4ZM7QzMX
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 3680 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 3680 svchcst.exe 3632 svchcst.exe 3720 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4844 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe 4844 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe 3680 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4844 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4844 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe 4844 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe 3680 svchcst.exe 3680 svchcst.exe 3632 svchcst.exe 3632 svchcst.exe 3720 svchcst.exe 3720 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4844 wrote to memory of 4196 4844 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe 89 PID 4844 wrote to memory of 4196 4844 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe 89 PID 4844 wrote to memory of 4196 4844 754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe 89 PID 4196 wrote to memory of 3680 4196 WScript.exe 95 PID 4196 wrote to memory of 3680 4196 WScript.exe 95 PID 4196 wrote to memory of 3680 4196 WScript.exe 95 PID 3680 wrote to memory of 3892 3680 svchcst.exe 96 PID 3680 wrote to memory of 3892 3680 svchcst.exe 96 PID 3680 wrote to memory of 3892 3680 svchcst.exe 96 PID 3680 wrote to memory of 4012 3680 svchcst.exe 97 PID 3680 wrote to memory of 4012 3680 svchcst.exe 97 PID 3680 wrote to memory of 4012 3680 svchcst.exe 97 PID 3892 wrote to memory of 3632 3892 WScript.exe 98 PID 3892 wrote to memory of 3632 3892 WScript.exe 98 PID 3892 wrote to memory of 3632 3892 WScript.exe 98 PID 4012 wrote to memory of 3720 4012 WScript.exe 99 PID 4012 wrote to memory of 3720 4012 WScript.exe 99 PID 4012 wrote to memory of 3720 4012 WScript.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe"C:\Users\Admin\AppData\Local\Temp\754645f81ad40f50b19fc32f39ea0a706d7b973c19999ee32e5f72f64daea118.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3632
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3720
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3784,i,3833046924978547022,12404847742964713612,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:81⤵PID:1168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 7c613351ce436a139f412d8b720812159acf156c48c96d68d923d95e2ed3f408
- MD5 799022f597f9d902c7668e0c74cf18f1
- SHA1 d89e33c28547e4fe5243e525d7d17a976e682eb8
- SHA512 32a50ba76319054a9b1ce3d7becd80b39bc88d0360e40b6178c01ab5262c33066e5935d68f56ccdeae6f3cc2b64238455dcddbab1772211ae6eb66a442543139
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 19f8d5209b4a5789cdfd5b67cb0b9f6c3546c62912bcb1ef1c69a15602beb652
- MD5 5ef4272f4d6f345fc8cc1b2f059c81b4
- SHA1 78bcb559f775d70e10396e1d6d7b95c28d2645d1
- SHA512 002693255c600456d965b5a7e36f780deec4d80cd9fe56f7f974b8762e2b140002a1dabf4b059d6163c9cc00a0e1e9da71899e13347fb4bb2985bbc7058469cb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 505a9a3604d99821b66a0e55e0d9108b918f9ea97285e9749b7f24b399fd70e1
- MD5 2902fc625fca8c9cdb62dc08cc19283b
- SHA1 76490d0ba76056b5141e9d20cb3103a300245ebf
- SHA512 bdd7c74842ac9ed142ff892cd03a3369c38d8327b8f36cef1ef610853a6c3c4273f41c4ab323c415dd8f4401fd88f6e9f311c210d0320bd4e04bae9f70e31dd0
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QY:CcaClSFlG4ZM7QzMP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 076c15e1d259ba7a9cbada3af75e12e4b789744580bd2a55cca5ca15878224bd
- MD5 657ee7395b662b96c2c7f39423bea805
- SHA1 277b37e8eec0b8362dae4469953e39fd20799ea6
- SHA512 168fef44fa5abdc5e4d625607b043510ace54741151c462324cdce1277e574f4f3e66fafd0748cf2dd3a7e41adea52791d9f90298cf841f555c068ab0e434012
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qt:CcaClSFlG4ZM7QzMm
- MD5 SHA1 SHA512 SSDEEP