Analysis
-
max time kernel
141s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 04:50
Static task
static1
Behavioral task
behavioral1
Sample
812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe
Resource
win10v2004-20240226-en
General
-
Target
812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe
-
Size
1.1MB
-
MD5
ecdd03327b5b7772de069c9eead50239
-
SHA1
0cc5066d15a5314caeea56b8aa8c3203df9e1983
-
SHA256
812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973
-
SHA512
ea498f1ae0050404237add5c063e40b9883562c5fe143765ca603558e718c08ae07129f6c52fd2e3fea23c3b3ee94d6cee4a15ad63341f2153f35e2803b0b6fd
-
SSDEEP
24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QO:acallSllG4ZM7QzMV
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe -
Deletes itself 1 IoCs
pid Process 5028 svchcst.exe -
Executes dropped EXE 3 IoCs
pid Process 3112 svchcst.exe 5028 svchcst.exe 1660 svchcst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe 5028 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 5028 svchcst.exe 5028 svchcst.exe 3112 svchcst.exe 3112 svchcst.exe 1660 svchcst.exe 1660 svchcst.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1616 wrote to memory of 3404 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 96 PID 1616 wrote to memory of 3404 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 96 PID 1616 wrote to memory of 3404 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 96 PID 1616 wrote to memory of 4124 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 95 PID 1616 wrote to memory of 4124 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 95 PID 1616 wrote to memory of 4124 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 95 PID 1616 wrote to memory of 696 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 93 PID 1616 wrote to memory of 696 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 93 PID 1616 wrote to memory of 696 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 93 PID 1616 wrote to memory of 4540 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 97 PID 1616 wrote to memory of 4540 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 97 PID 1616 wrote to memory of 4540 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 97 PID 1616 wrote to memory of 2904 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 94 PID 1616 wrote to memory of 2904 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 94 PID 1616 wrote to memory of 2904 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 94 PID 1616 wrote to memory of 1200 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 91 PID 1616 wrote to memory of 1200 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 91 PID 1616 wrote to memory of 1200 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 91 PID 1616 wrote to memory of 4812 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 92 PID 1616 wrote to memory of 4812 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 92 PID 1616 wrote to memory of 4812 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 92 PID 1616 wrote to memory of 2120 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 98 PID 1616 wrote to memory of 2120 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 98 PID 1616 wrote to memory of 2120 1616 812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe 98 PID 3404 wrote to memory of 3112 3404 WScript.exe 100 PID 3404 wrote to memory of 3112 3404 WScript.exe 100 PID 3404 wrote to memory of 3112 3404 WScript.exe 100 PID 2120 wrote to memory of 5028 2120 WScript.exe 101 PID 2120 wrote to memory of 5028 2120 WScript.exe 101 PID 2120 wrote to memory of 5028 2120 WScript.exe 101 PID 2904 wrote to memory of 1660 2904 WScript.exe 102 PID 2904 wrote to memory of 1660 2904 WScript.exe 102 PID 2904 wrote to memory of 1660 2904 WScript.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe"C:\Users\Admin\AppData\Local\Temp\812cbf49eddeddf09f1459b4661024a4a5c20e900bf968ad46e0260909969973.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵PID:1200
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵PID:4812
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵PID:696
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵PID:4124
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3112
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵PID:4540
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5028
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:1616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753B
MD5dd67b0be652da6b1dee82dfa31f66a7b
SHA130c86db709d87ab52a330ab3c60c1d597d15842d
SHA2561702100805c8c1bcf4f1be2f7db9c5eb80b867f31b3ad4f6310bbf1ed5aef0c1
SHA512c22421cd5727264784d8e36380327d5ae9d85f6927c3f35e3cf2e18377e54ff05e554518f2d5fc33ffacd57c0315760f701e6f8f7f252eb98e37fbcab423472a
-
Filesize
1.1MB
MD579400e7a5dc1c2e9381c30d40ec1e710
SHA19d9649cd14e96a9231beaf39f093e1adf3960ac5
SHA256099cf4388f0a8d919414c5990c3d0bbdaf1d070eeb3c800b7c0615c66684e589
SHA512299e940406a1757ec2d465b7b9ccb1cec386fbd3d3347826aded706529eaf487f52a3e0360527f1e9ac50965f4c2b84c7e32190e3609c86964dd74595f7f43c6