Analysis
- max time kernel
115s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 18:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe
- Size 1.1MB
- Sample240613-xf8flasbll
- SHA256 fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c
- MD5 a0572fb4a0dae35590d57a9345a6edfe
- SHA1 e318f9110dc2ad2c7e6cfb89f4a9d8e67334646e
- SHA512 a77893997cbc9159d03469cf0e0f9255f3d08b67ca50fe7a3c4d08bd29bf6e9418e831f8e74dd259adf4d2f80d39893a4973f2474fefe3da4778c69fe0c75e11
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QO:acallSllG4ZM7QzMV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 3580 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 3580 svchcst.exe 3660 svchcst.exe 404 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3808 fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe 3808 fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe 3580 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3808 fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3808 fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe 3808 fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe 3580 svchcst.exe 3580 svchcst.exe 3660 svchcst.exe 3660 svchcst.exe 404 svchcst.exe 404 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3808 wrote to memory of 2016 3808 fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe 92 PID 3808 wrote to memory of 2016 3808 fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe 92 PID 3808 wrote to memory of 2016 3808 fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe 92 PID 2016 wrote to memory of 3580 2016 WScript.exe 99 PID 2016 wrote to memory of 3580 2016 WScript.exe 99 PID 2016 wrote to memory of 3580 2016 WScript.exe 99 PID 3580 wrote to memory of 4920 3580 svchcst.exe 100 PID 3580 wrote to memory of 4920 3580 svchcst.exe 100 PID 3580 wrote to memory of 4920 3580 svchcst.exe 100 PID 3580 wrote to memory of 4464 3580 svchcst.exe 101 PID 3580 wrote to memory of 4464 3580 svchcst.exe 101 PID 3580 wrote to memory of 4464 3580 svchcst.exe 101 PID 4464 wrote to memory of 404 4464 WScript.exe 104 PID 4464 wrote to memory of 404 4464 WScript.exe 104 PID 4464 wrote to memory of 404 4464 WScript.exe 104 PID 4920 wrote to memory of 3660 4920 WScript.exe 103 PID 4920 wrote to memory of 3660 4920 WScript.exe 103 PID 4920 wrote to memory of 3660 4920 WScript.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe"C:\Users\Admin\AppData\Local\Temp\fe09e35e4cfe90539407f3039019c0f8f233d6c53ce140d70bd20a22ad57074c.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3660
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:404
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4408,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:81⤵PID:2908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 6ba8498e50d16dedd7a4479998981b504b684f524c08329269fd4eb6e3fe52a2
- MD5 ddd204c2596c95e0b37f2faf17345158
- SHA1 fb5c9a676eb0b0e08ed0498a5696bbd7d443b1a2
- SHA512 17f8ff158d74cb8b37954cd5d458440cbf7e41dd03d08d5101b55f7ca259fdd1e36967e5231a31362c68456d0e91bdbac1c83cc19876ab7ec1c97bde0ec03244
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 adc8bf0a43c3258d71e77331b5df1accc65e33c3d0453486264256826e09f0ee
- MD5 0f9529e559e29fb0bed1216e42714e6b
- SHA1 449bc6c9bd82cbd0173340ba3bc769fada09d37d
- SHA512 e361fb1a901e3fc6698be4fbc2c4a3d9d9828dd934249626932c0c2b3c1335b76f3100ea5d7076b70d18be745f5cb8a57b522da42b98c6310f390704142fcb12
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 0ef0f143ae4e304e92a374478a89725df393558c53e42fca410e3c40264d22f6
- MD5 4451cd23f243b9808a36b6d3d0826aa8
- SHA1 60e3bbbc88c4b82bc1e16eebb76124a3b5bc087f
- SHA512 09da8d462eb515235810659dd6b722b10399b635926e47893c6cb9ac3e0a4a7b6ca8db95da6f5b7ee98d1ae485b99dd848216461c7ef199e28509ba08d2654da
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QU:acallSllG4ZM7QzMD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 1010af1551e87d860e65b442874b140ace23475775ebc14b2dc828603188bdf1
- MD5 52076f25e19b29e659a8f81106ecf89d
- SHA1 08ede473c2867f2eb6503fc37e975d6df60ca105
- SHA512 12bda9a3d98a8fb195be4469f69870e8e310f4b2b30c4b947883bce4825cb098289411842aa0655b0ab83e1b7fc96a80b5abfd2a3c18c685908dc3a24330db4d
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QC:acallSllG4ZM7QzMh
- MD5 SHA1 SHA512 SSDEEP