Analysis
- max time kernel
125s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 19:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe
- Size 1.1MB
- Sample240613-yk91nashll
- SHA256 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322
- MD5 da865addd43897c46094e88149cc0e09
- SHA1 11314bcde5bbef7ba372935a04f135a1bcf092bc
- SHA512 7d5376d8765742f10f02d660213bccec88b61db701dcd2f0d71eaf96f46d2511f65c619e583a41d55a770934a96fa4d3d1585415f6f0824cfff16489b8e5248d
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QR:acallSllG4ZM7QzMi
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 1020 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 1020 svchcst.exe 1676 svchcst.exe 1460 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings svchcst.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1604 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe 1604 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe 1020 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1604 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1604 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe 1604 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe 1020 svchcst.exe 1020 svchcst.exe 1676 svchcst.exe 1676 svchcst.exe 1460 svchcst.exe 1460 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1604 wrote to memory of 2252 1604 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe 91 PID 1604 wrote to memory of 2252 1604 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe 91 PID 1604 wrote to memory of 2252 1604 1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe 91 PID 2252 wrote to memory of 1020 2252 WScript.exe 95 PID 2252 wrote to memory of 1020 2252 WScript.exe 95 PID 2252 wrote to memory of 1020 2252 WScript.exe 95 PID 1020 wrote to memory of 4184 1020 svchcst.exe 96 PID 1020 wrote to memory of 4184 1020 svchcst.exe 96 PID 1020 wrote to memory of 4184 1020 svchcst.exe 96 PID 1020 wrote to memory of 4320 1020 svchcst.exe 97 PID 1020 wrote to memory of 4320 1020 svchcst.exe 97 PID 1020 wrote to memory of 4320 1020 svchcst.exe 97 PID 4184 wrote to memory of 1676 4184 WScript.exe 98 PID 4184 wrote to memory of 1676 4184 WScript.exe 98 PID 4184 wrote to memory of 1676 4184 WScript.exe 98 PID 4320 wrote to memory of 1460 4320 WScript.exe 99 PID 4320 wrote to memory of 1460 4320 WScript.exe 99 PID 4320 wrote to memory of 1460 4320 WScript.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe"C:\Users\Admin\AppData\Local\Temp\1a334a2ed3ada0e4510b17fb62f66e09fc408973067eebec7b41590e29b60322.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1676
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4272,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:81⤵PID:3712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 488ef21e6c158a94892efc2bd9046b0fef3e610e6a06a7689a38e2344605d721
- MD5 5d76e8dbbb0979db543b3718ff5142cd
- SHA1 0bc50de9dc37c5ab900cae38778e920fc68d8381
- SHA512 31165bde3c68a306851bdb24ab99db317bcc4e852d415c4982199b971fa9bbd7761cc32bea81cd0e3ec4bc4279d02421fc34e4043041a599fc236b6263861fb8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 923ae6b14f6c2bebf34efcf9db8485390ca298cdb952df04bc457df9c45647b3
- MD5 8b412aa0b6687b4da946906a06c460fa
- SHA1 180bb2d6f0645242e91d23e76043c0301916f7f5
- SHA512 73d949f5159a7c976e250d20b975fff6469d5c41b47488d9738a3466dfb372c7977846f6d8fbf676e07715a5fe284ca1597b74f090e0b55301314f71522ac143
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 457a911676a29ab29712b0d2e4d72d48af51e00c0d2a8ec750d701d27b3a38c8
- MD5 3ea7b4eb393f043e2df4e1f203c50036
- SHA1 1f842cf3f97c6b42df39230029e6d47917165c4b
- SHA512 717d50c481b97405bf533a2314625fbb3f74e7a409cd470963cc5ccfdf0e956a4c75e5433ca199c612680160510704d8094aef8a142a9854dd61a2d0abf725d7
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QT:acallSllG4ZM7QzMk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 ea33329afffce07b3cc211a981bb2c4b39a7564886b6bf822071e9e13e71e350
- MD5 8abbeb045340291b1f9bc24e3f5d4a76
- SHA1 4c0e1f4f100b783548078caa2a4e847cf3f02430
- SHA512 a07422736c4b23762d1cab8d32598e8ad8659367b9f3f24c93bda46b80a20bce6b3a12c8ba38408a2c94cf3008e5a6f2241b86bec1e7f5e43e47d71407e66cb6
- SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qp:acallSllG4ZM7QzMK
- MD5 SHA1 SHA512 SSDEEP