Analysis
- max time kernel
52s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 19:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe
- Size 1.1MB
- Sample240613-ydeaeayejd
- SHA256 e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957
- MD5 9e6c4f32d8ea4fae97c5a5db54118699
- SHA1 60330b30125422026eaf1ddc7531c3b6181ff193
- SHA512 810e01aac12bdc46e34fec6456cbbf2c851aad5f1f10e79ec1b9104e2bb215f4808aad475f16a2ce86f2d943e4518adf262f6cb8714db03fab636c2945b0179a
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qu:acallSllG4ZM7QzMF
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe - Deletes itself 1 IoCs
pid Process 2732 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 2732 svchcst.exe 1048 svchcst.exe 696 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1936 e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe 1936 e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe 2732 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1936 e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1936 e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe 1936 e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe 2732 svchcst.exe 2732 svchcst.exe 696 svchcst.exe 696 svchcst.exe 1048 svchcst.exe 1048 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1936 wrote to memory of 4568 1936 e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe 83 PID 1936 wrote to memory of 4568 1936 e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe 83 PID 1936 wrote to memory of 4568 1936 e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe 83 PID 4568 wrote to memory of 2732 4568 WScript.exe 87 PID 4568 wrote to memory of 2732 4568 WScript.exe 87 PID 4568 wrote to memory of 2732 4568 WScript.exe 87 PID 2732 wrote to memory of 4376 2732 svchcst.exe 88 PID 2732 wrote to memory of 4376 2732 svchcst.exe 88 PID 2732 wrote to memory of 4376 2732 svchcst.exe 88 PID 2732 wrote to memory of 412 2732 svchcst.exe 89 PID 2732 wrote to memory of 412 2732 svchcst.exe 89 PID 2732 wrote to memory of 412 2732 svchcst.exe 89 PID 4376 wrote to memory of 696 4376 WScript.exe 91 PID 4376 wrote to memory of 696 4376 WScript.exe 91 PID 4376 wrote to memory of 696 4376 WScript.exe 91 PID 412 wrote to memory of 1048 412 WScript.exe 90 PID 412 wrote to memory of 1048 412 WScript.exe 90 PID 412 wrote to memory of 1048 412 WScript.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe"C:\Users\Admin\AppData\Local\Temp\e9e28458c206d6418d7c029ab534431d58e2ec8b617ede23f5b46ec0f10e5957.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:696
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1048
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 7ac0c74de647ef78ef6fffba49310f3c9c1b7d9ad19121d3502ec03c6e412a42
- MD5 8364c7b31d7cc2ff033d43e692633d35
- SHA1 8c51dd902e1739104aff48093aecb669522fea1f
- SHA512 0615c03be93f2b8cadfa7f0fca0ec6a790728d61980a9cd5edc372c99d3d73c5bdd1e6abfc055d4bd7ff2a2aa67f6fd5221c0d0479e33ac6736522fdc0572571
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 936e64ac103cd2a3ae123836dc931a71f3d0ca5ab43c043dc12d47300af7f5a1
- MD5 6ce9e85859695540f0c105a5efdfd289
- SHA1 c80848af3529a6e909ce38a05d96b46930118bf3
- SHA512 e78c4878f27fd4bc7abde263f1010d115b1017fa3998ac3d004f028fec3e5641fb298f94bbc2951227cace816ca1ff723400bb728a7817b6872cf5572ca958a9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 121477b4abfd3959bca47723b3a24406b84e648fa0039935eae7cf3b2dc342a2
- MD5 39402e8c2b869855ca3cbbfd06f18153
- SHA1 f2ca5b6dad757093039e3afc9359efdf98b46c97
- SHA512 83a0e93177ae51d5a52e3975fc82d63234c8edc06b55287d87af1f11fba083240829eef67b2d01e83c91cd1473982d6cce0e6f1effc5a232815e2c540f35b302
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qa:acallSllG4ZM7QzMZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 25484d34a0788d37bf5673fc1c55e43e4bdcec2f68797d03fd03ae33a3c3078c
- MD5 6ddee8e232015eaf59d9ca25b05e85e8
- SHA1 88759bfeaf0395d8c230954b332919bdd6dd03c1
- SHA512 3f086de74f5bf9b4a53b31484d60c0bf49a708b1633c6d98e8a9a47f48a90618f72b4a71cb98e86187d787488f7804c6ed6b2e62d642d733faba707102297854
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QX:acallSllG4ZM7QzMw
- MD5 SHA1 SHA512 SSDEEP