Analysis
- max time kernel
62s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe
- Size 1.1MB
- Sample240613-ybl78sydph
- SHA256 f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b
- MD5 c18624a38f7cadcc83b0c8d6339bf821
- SHA1 feac6d95983f198118827d17589b3ecbce8045bc
- SHA512 05ef49259c01e0c31cacc63e4ec4cf71c98143da3c17e9c0b88ee4642a0dc840e6f9ec5f7b2e0a474c7ac8b1542ff0e151c9f9ab63cb550f1981396ff7fa214b
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qb:acallSllG4ZM7QzMs
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation svchcst.exe - Deletes itself 1 IoCs
pid Process 2068 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 2068 svchcst.exe 208 svchcst.exe 2284 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings svchcst.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe 2976 f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe 2068 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2976 f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2976 f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe 2976 f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe 2068 svchcst.exe 2068 svchcst.exe 208 svchcst.exe 208 svchcst.exe 2284 svchcst.exe 2284 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2976 wrote to memory of 4444 2976 f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe 83 PID 2976 wrote to memory of 4444 2976 f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe 83 PID 2976 wrote to memory of 4444 2976 f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe 83 PID 4444 wrote to memory of 2068 4444 WScript.exe 87 PID 4444 wrote to memory of 2068 4444 WScript.exe 87 PID 4444 wrote to memory of 2068 4444 WScript.exe 87 PID 2068 wrote to memory of 1332 2068 svchcst.exe 88 PID 2068 wrote to memory of 1332 2068 svchcst.exe 88 PID 2068 wrote to memory of 1332 2068 svchcst.exe 88 PID 2068 wrote to memory of 1212 2068 svchcst.exe 89 PID 2068 wrote to memory of 1212 2068 svchcst.exe 89 PID 2068 wrote to memory of 1212 2068 svchcst.exe 89 PID 1212 wrote to memory of 208 1212 WScript.exe 90 PID 1212 wrote to memory of 208 1212 WScript.exe 90 PID 1212 wrote to memory of 208 1212 WScript.exe 90 PID 1332 wrote to memory of 2284 1332 WScript.exe 91 PID 1332 wrote to memory of 2284 1332 WScript.exe 91 PID 1332 wrote to memory of 2284 1332 WScript.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe"C:\Users\Admin\AppData\Local\Temp\f7be38b436789652b873516d5c6a601d7382ee6d082ed40a2300beb93219051b.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2284
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:208
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 2abd0c0ae088f6c911f23add50e985c447f1c62c8a45f848698b08d6e6dd20e7
- MD5 4e9605159361f93230fef3cc5ad4301c
- SHA1 64e6d5673487e049cc4e96650b507641062ca1bf
- SHA512 5cf02982826cc6e08ea33c4ce5d186ad4277493480cf08c2df56a7deea87e58a6df3a95097c96409a89317528933e0999d4ccddc2403024bd04b6e1c312f42fe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 2987004b5408874674481f9e506ebaa13acb7fd780e451288df7a2df7ba7e510
- MD5 e7e8f5ccc601af3fd8f8f18f586a796a
- SHA1 cc7819e7eaba0b1156c41564ff310962a78c18f7
- SHA512 38032cccf9cbc5144c1a9ac013330802639885142731c8102f90e78cd68041bd48a2629ca0eb4363cfa62fb74b889b8bd134f0d9647233cb9d1c98e1ff4f1639
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 f5437a0461ef7d1d5f179fe763e735fa8a093438be0642f04ab381d2087f8ea0
- MD5 29e935027a925ca0c02151a1512edabb
- SHA1 968746f6660342856700f09b8b623594f0cc7b94
- SHA512 2a2b29b3221ad359f234770c81f30683e051c7542d37d4325b9c019f13353b5954b6d7d1ab5940b86496dfc41ce7a9180eb37e760e8d92194a2ee87cd898d216
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QE:acallSllG4ZM7QzMj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 ffd4a3e6a9daa9129fdf0f1f4a0bc55675ae66f894747d2a822449fa0484949c
- MD5 9ec33111cd91d1b6355ecb85fb83743f
- SHA1 10d0adf751ebd8656fca6e14d7ef14189e3af716
- SHA512 042f1f48e5aa8e8b24ba5ef612334660ad9f61ca9f31450b5ea14ef78c6ee58c2f69be45962fcd9c60f8c0b5db8ec7c4c8951c6f2393e17f4619ca8f83be40f0
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q0:acallSllG4ZM7QzMj
- MD5 SHA1 SHA512 SSDEEP