Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 19:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe
- Size 1.1MB
- Sample240613-yle7nsyfnf
- SHA256 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a
- MD5 99b383f8b7c2cfd5174198e3d108cbfe
- SHA1 608ffe8f3fe22c8d3f09a40187d6896b3b4d05fe
- SHA512 500adb64bfd4365e558ba0f8fa32f9598b0ac47fa8daf080ad348d2de814fe252fb08020f112e52244410ce2d279c1558d8fe47aad63572d5ed71d448cf1faca
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QQ:CcaClSFlG4ZM7QzMn
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe - Deletes itself 1 IoCs
pid Process 5012 svchcst.exe - Executes dropped EXE 3 IoCs
pid Process 5012 svchcst.exe 3096 svchcst.exe 5080 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 660 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe 660 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe 5012 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 660 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 660 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe 660 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe 5012 svchcst.exe 5012 svchcst.exe 5080 svchcst.exe 5080 svchcst.exe 3096 svchcst.exe 3096 svchcst.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 660 wrote to memory of 2844 660 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe 81 PID 660 wrote to memory of 2844 660 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe 81 PID 660 wrote to memory of 2844 660 0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe 81 PID 2844 wrote to memory of 5012 2844 WScript.exe 87 PID 2844 wrote to memory of 5012 2844 WScript.exe 87 PID 2844 wrote to memory of 5012 2844 WScript.exe 87 PID 5012 wrote to memory of 3240 5012 svchcst.exe 88 PID 5012 wrote to memory of 3240 5012 svchcst.exe 88 PID 5012 wrote to memory of 3240 5012 svchcst.exe 88 PID 5012 wrote to memory of 4756 5012 svchcst.exe 89 PID 5012 wrote to memory of 4756 5012 svchcst.exe 89 PID 5012 wrote to memory of 4756 5012 svchcst.exe 89 PID 4756 wrote to memory of 3096 4756 WScript.exe 91 PID 4756 wrote to memory of 3096 4756 WScript.exe 91 PID 4756 wrote to memory of 3096 4756 WScript.exe 91 PID 3240 wrote to memory of 5080 3240 WScript.exe 90 PID 3240 wrote to memory of 5080 3240 WScript.exe 90 PID 3240 wrote to memory of 5080 3240 WScript.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe"C:\Users\Admin\AppData\Local\Temp\0c0d3cbe1b36f5d1d631dca758c13457799f7f8f1f1199b34e79c44ec533483a.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5080
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3096
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 0d0a8daeceed64600e817a5a0437a39048c52e857868a35d9130d42fdfa896ed
- MD5 072a46f071251f08c67b3aba4c983435
- SHA1 371837f885eac20c802901026d2e7aa1d4f6cd5c
- SHA512 e3d35d428a29eec047b0cc43c87aa701eed81e9efe921b4ef13fa2e8e24ef11ce602bd67868b7ad1bdbd9f39eb681a8c95c715479238a2f17c17105ea4653c83
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 c9036bdd473137d4e60ca47c24bf64368a5e7f1e22511b7c4b899030dfcc98a7
- MD5 6d8c56f1ffad29aecdcceb0a645ec374
- SHA1 2d715669c90f7f9d0a0cc9faf2c89b6138ad4cb1
- SHA512 9ebe8b814aaf192bd2ba767fa35c2830d4b67e04a1901c2898eae045082279417996cb61cf5f64d94a2f28f3ba83cb78790673bec74eaf22d7ce2f081ebfe325
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 88e50b2d9fc8570ffbdf74a0efe4ecc1e39a0a1f4fe4edc420d5d841e8c81a6a
- MD5 4ed0fabb64d604bfb18bd074c82b91ce
- SHA1 eb7b9ff9ffa1f364c8c969a9585d0a817921aa34
- SHA512 cb7944a20f5348457abfc08d34512b2072a4cb6c714badc6706fb57eeaec73affef788202096ea46f563ba8459fd111544f91d3285209875c080afb8ff2b0cd5
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qd:CcaClSFlG4ZM7QzM2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 c45e52f25ad5c125cb58da7a2c429433ca5ae378f8baaef8f32b51eb2e90054f
- MD5 84d29f1a2006f627ff341f4e2ae9da7a
- SHA1 16eca226fba2231e3e3010971850198a53f4c58f
- SHA512 e45de773fc1ae630b86f52e27b952095775946b47d9180e4a1d4b99b2d773a70b57db7bbe3a57b6f2eb601604f3e96d43ceeb6d566e6d7340fb1d010efdc69cf
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QM:CcaClSFlG4ZM7QzML
- MD5 SHA1 SHA512 SSDEEP