Overview

overview

7

Static

static

3

7742bcc2e9...64.exe

windows7-x64

7

7742bcc2e9...64.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    52s
  • max time network
    53s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 02:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7742bcc2e93cb918a7462ff4a6c13b4c0113897116d301b40e507d6855d44064.exe

  • Size

    1.1MB

  • MD5

    40d45dfd7664527faca36683ce2b317d

  • SHA1

    004cb2607dd519da25e181eb5f9135d7cf1d393e

  • SHA256

    7742bcc2e93cb918a7462ff4a6c13b4c0113897116d301b40e507d6855d44064

  • SHA512

    9490217320a6e48af0019fa54e1a13677d3d0df18894561f29344549a86bafed2d02a5c9b9f62dcc856098e794469dd6bb21778e4d925214f487556315823d13

  • SSDEEP

    24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QC:CcaClSFlG4ZM7QzMR

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7742bcc2e93cb918a7462ff4a6c13b4c0113897116d301b40e507d6855d44064.exe
    "C:\Users\Admin\AppData\Local\Temp\7742bcc2e93cb918a7462ff4a6c13b4c0113897116d301b40e507d6855d44064.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1676
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3528

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
          Filesize

          753B

          MD5

          ffc67aea4bf61d56ec6335dee1778c8a

          SHA1

          836ee02ea79df62ec9e0c7174586bf3f65372c84

          SHA256

          48546aa2fe3fe4c247540bd5e946575b2563cab9a70085d05cb267c50eecda1b

          SHA512

          60bbaa4579e50aa6119fe251417570effd91a5608f97ac12602ad40456c165d78b7e7bbdc33e0bc54ead9ca020c2d9d71b5f83b61352fd6348d504ab89e8a3c6

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
          Filesize

          1.1MB

          MD5

          21c90718a2f28b9d46af82cc89d656f5

          SHA1

          324e4db683f148e120ca19f812999e10c2ec028a

          SHA256

          51e441df13ba821c98e994a6673814dfe759efd35345eafd46373f277e6cb069

          SHA512

          efde07a5af0aba532f607f72c0f228454bbbbbe23eb65dd3176a4a4068c9d98710e1a3e818d67fc515d4bca212319cdc7c08ffe57b2ecefeac3cc2dbd0593880

          Download Submit

        • memory/2156-10-0x0000000000400000-0x0000000000551000-memory.dmp

          Filesize

          1.3MB

          Download