Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe
- Size 1.1MB
- Sample240613-ydhb3ayeka
- SHA256 a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136
- MD5 0d591c8fdd509c0b792a728cced0c18a
- SHA1 1be49979130731ff63b066e83345da66783af7e0
- SHA512 920fff26f28952718f452bc88959483a71a1d5ca674141575d2a8b64c55886bc29b6f2b5126cc1be5e8dca8722cd803259a9621e86b85f8652552ae670b8ddcf
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qf:CcaClSFlG4ZM7QzM4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation svchcst.exe - Deletes itself 1 IoCs
pid Process 2572 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 2572 svchcst.exe 3004 svchcst.exe 1600 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5108 a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe 5108 a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe 2572 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 5108 a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5108 a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe 5108 a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe 2572 svchcst.exe 2572 svchcst.exe 3004 svchcst.exe 3004 svchcst.exe 1600 svchcst.exe 1600 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 5108 wrote to memory of 4068 5108 a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe 84 PID 5108 wrote to memory of 4068 5108 a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe 84 PID 5108 wrote to memory of 4068 5108 a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe 84 PID 4068 wrote to memory of 2572 4068 WScript.exe 87 PID 4068 wrote to memory of 2572 4068 WScript.exe 87 PID 4068 wrote to memory of 2572 4068 WScript.exe 87 PID 2572 wrote to memory of 2384 2572 svchcst.exe 88 PID 2572 wrote to memory of 2384 2572 svchcst.exe 88 PID 2572 wrote to memory of 2384 2572 svchcst.exe 88 PID 2572 wrote to memory of 752 2572 svchcst.exe 89 PID 2572 wrote to memory of 752 2572 svchcst.exe 89 PID 2572 wrote to memory of 752 2572 svchcst.exe 89 PID 752 wrote to memory of 3004 752 WScript.exe 90 PID 752 wrote to memory of 3004 752 WScript.exe 90 PID 752 wrote to memory of 3004 752 WScript.exe 90 PID 2384 wrote to memory of 1600 2384 WScript.exe 91 PID 2384 wrote to memory of 1600 2384 WScript.exe 91 PID 2384 wrote to memory of 1600 2384 WScript.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe"C:\Users\Admin\AppData\Local\Temp\a651bb3be9fa2029bd755528df00da79e3dc6820d6f832c973636c21916f1136.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1600
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3004
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 40de55c3ddec4b015c3d28d5eae30d2cd1e111c942ea7c17861e530f16afb536
- MD5 6781778113b1e87542eca9a5117aed41
- SHA1 7fbdf9a11cc3cc20eefd943efd401b0b56ac515d
- SHA512 2b46fcafa8fb8e3ac83bcd7df08b22c3e55d8a18e09feac5ff866d7dbe310afaa370b068d513369bc03a03505045e94d3518de81dd3ad99dc79341594f4b286f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 ca82157de4bf3edea1ce728fea480f64259153ea391b2be7b5f59864c0ae7a53
- MD5 80ebf5d44551af5680e6faa0b57e8c8b
- SHA1 2e17219fbf9ac0ffaf25efb6a11dfe6e9e404798
- SHA512 a96c9d64087a4b9eccb235e9e1b19da6adfa1adc40ea11eca5cca69cc7b57eb4c3a299eb2103768398d99aee534c3eced7e76099917c52d1499ea9af07ba2ca8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 65add434b0957ce49a82ac1342aacc011481df1edf3db62e6065435319a70279
- MD5 9c31959f1990c25d05ecedc057c84b2e
- SHA1 3b01bb6710960c601765a2792615e61a1518a7ab
- SHA512 bf17fe7b068c42ecbd75ea879b88141177791996677eefe55cca838317bcb554b356c2b202a5edd578adf634522caa1a7149a0edb1caf1347aa77e809e115f24
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QX:CcaClSFlG4ZM7QzMA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 d314e28703ad671f79611586c9c8358dd6479505cdd40aa1592f4cf940ad77f5
- MD5 e768b564b10ea2b0e852841603145056
- SHA1 324825018651cb7190ab7fa3cf511c62b341ae3b
- SHA512 6c3068c4e53926ae8109004044fbe85e87f702e79e807fe949a26460e25849f05e0b682029fd69a5d85700a217c834a4dee0ae3ffdb2a667060090a77d6f8a05
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qo:CcaClSFlG4ZM7QzMP
- MD5 SHA1 SHA512 SSDEEP