Analysis
- max time kernel
135s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
30/06/2024, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe
- Size 1.1MB
- Sample240630-3erpcascqr
- SHA256 e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4
- MD5 77cc7d05ca34a01aa15e06f7d2d2bfcb
- SHA1 960695a62fabbba65517f838e056cb692264c105
- SHA512 7ce34b1cbe9b96d0643bf2dd8dcad3d8a2ceda5f39853c8ce072e0ab8431c317809027d125f3c1b1bf9e116ad1159fa398efc968fe25ed715c86a08c1edd6b52
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qf:CcaClSFlG4ZM7QzMY
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 4236 svchcst.exe - Executes dropped EXE 6 IoCs
pid Process 4236 svchcst.exe 400 svchcst.exe 5060 svchcst.exe 4512 svchcst.exe 4632 svchcst.exe 2532 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4748 e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe 4748 e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe 4236 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4748 e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4748 e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe 4748 e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe 4236 svchcst.exe 4236 svchcst.exe 5060 svchcst.exe 5060 svchcst.exe 400 svchcst.exe 400 svchcst.exe 4512 svchcst.exe 4512 svchcst.exe 2532 svchcst.exe 4632 svchcst.exe 2532 svchcst.exe 4632 svchcst.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4748 wrote to memory of 1540 4748 e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe 83 PID 4748 wrote to memory of 1540 4748 e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe 83 PID 4748 wrote to memory of 1540 4748 e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe 83 PID 1540 wrote to memory of 4236 1540 WScript.exe 92 PID 1540 wrote to memory of 4236 1540 WScript.exe 92 PID 1540 wrote to memory of 4236 1540 WScript.exe 92 PID 4236 wrote to memory of 2624 4236 svchcst.exe 93 PID 4236 wrote to memory of 2624 4236 svchcst.exe 93 PID 4236 wrote to memory of 2624 4236 svchcst.exe 93 PID 4236 wrote to memory of 3956 4236 svchcst.exe 94 PID 4236 wrote to memory of 3956 4236 svchcst.exe 94 PID 4236 wrote to memory of 3956 4236 svchcst.exe 94 PID 3956 wrote to memory of 5060 3956 WScript.exe 98 PID 2624 wrote to memory of 400 2624 WScript.exe 97 PID 3956 wrote to memory of 5060 3956 WScript.exe 98 PID 2624 wrote to memory of 400 2624 WScript.exe 97 PID 3956 wrote to memory of 5060 3956 WScript.exe 98 PID 2624 wrote to memory of 400 2624 WScript.exe 97 PID 5060 wrote to memory of 1772 5060 svchcst.exe 99 PID 5060 wrote to memory of 1772 5060 svchcst.exe 99 PID 5060 wrote to memory of 1772 5060 svchcst.exe 99 PID 5060 wrote to memory of 4020 5060 svchcst.exe 100 PID 5060 wrote to memory of 4020 5060 svchcst.exe 100 PID 5060 wrote to memory of 4020 5060 svchcst.exe 100 PID 4020 wrote to memory of 4512 4020 WScript.exe 101 PID 4020 wrote to memory of 4512 4020 WScript.exe 101 PID 4020 wrote to memory of 4512 4020 WScript.exe 101 PID 4512 wrote to memory of 4332 4512 svchcst.exe 103 PID 4512 wrote to memory of 4332 4512 svchcst.exe 103 PID 4512 wrote to memory of 4332 4512 svchcst.exe 103 PID 4512 wrote to memory of 4672 4512 svchcst.exe 102 PID 4512 wrote to memory of 4672 4512 svchcst.exe 102 PID 4512 wrote to memory of 4672 4512 svchcst.exe 102 PID 4672 wrote to memory of 4632 4672 WScript.exe 104 PID 4672 wrote to memory of 4632 4672 WScript.exe 104 PID 4672 wrote to memory of 4632 4672 WScript.exe 104 PID 4332 wrote to memory of 2532 4332 WScript.exe 105 PID 4332 wrote to memory of 2532 4332 WScript.exe 105 PID 4332 wrote to memory of 2532 4332 WScript.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe"C:\Users\Admin\AppData\Local\Temp\e16260505e9c2bd9fcdb9d83b64899b075b7cd2790ff7b0987c61b9bb51410a4.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:400
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵PID:1772
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4632
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2532
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 4eed6a5c4f010b8604f822c91683ba0cf9c2c1f7fd803bcd9c05bfd36d84f37a
- MD5 c0b5050d31a3c3086d56cf03dbf39e65
- SHA1 2f16721133b7efffc3b7c495803a409b47223c1f
- SHA512 be8a9ade498e5b54e7ca07bb3f9f114962847942d282e46e2b4f3e53704b27b47853c7bc60e5fdfc777b6e1fa2f8d34aa0d3321354c8a6b81d1640ce7780d9d5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 bbd8749995b7f218975a3955fac72a16d1f5a3fd3826f7bb98d0b4fe537d6697
- MD5 d32955f30e8aad52247ece470e41d5ad
- SHA1 ac6775ee1d2cccafe3baeb722ca57bf16953f173
- SHA512 1a00595cdfca51c9c95101a1d04a15089aded3fc687de721d882c6ef57697a943c0a99d917167e76d55040c5d8607e01fe5a206054112635a642f6364d3fdcaf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 f224737a0b43209e94acc9185ad29b226aa97dca404840dd0e1c4ca85c99fcc4
- MD5 710e0a17be627525c3d385d3c28597b6
- SHA1 7c3f970b7336fd3bfe51b85b79514d0fb6294858
- SHA512 d42aa7f3fb96831a08b982efe12dcfa689f62105493044d568e0aa72533361b42efd632dab1fbfe6a0cb896c3871a4dbeddeb462ffe75519497ec4ff52982de3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 0d0a8daeceed64600e817a5a0437a39048c52e857868a35d9130d42fdfa896ed
- MD5 072a46f071251f08c67b3aba4c983435
- SHA1 371837f885eac20c802901026d2e7aa1d4f6cd5c
- SHA512 e3d35d428a29eec047b0cc43c87aa701eed81e9efe921b4ef13fa2e8e24ef11ce602bd67868b7ad1bdbd9f39eb681a8c95c715479238a2f17c17105ea4653c83
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 d1193d47195756640b95168e7bc3f81b124f6666c2d852840b54b63641ce1ee3
- MD5 ac85cf492ccebdb5640df483101a742e
- SHA1 289cff0d0eb8918f19371cef4ebd6dc8639be8fd
- SHA512 18a906610c683f4cc5a2af6270bd3336d2675cdc2f0d3d64c9229088ead645a719d16011386ab8cc5b89465a67a51c6e3494c3b2fa966077f9118fd7a6ecbfe5
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qc:CcaClSFlG4ZM7QzMb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 e9c849760702deda0945275f0fd0e00e5745eaf995d3e26fb8a58a70691d3937
- MD5 72ee9ac71a363af9ad18baad11bf97f3
- SHA1 c254e8072666872371a9f244f7eb091464aa62c7
- SHA512 4d3f60530aaf000aa89ed782e25efcfe1886c5b008f12f2258e9a8ae9f7ad1e3d3da4e1181a965f71708c2deeca021d00fcb1c5acb2f0c9d412a29c51867745a
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Q3:CcaClSFlG4ZM7QzMQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 c3b204e701a8f9dd445a23a5ec41b608c359d84dd8e85a1218cfa5eb39377dff
- MD5 4e70b2597cd1d59b75b73beb242dbe26
- SHA1 d50726355b91f8535d2b51af1ea17320fc4e274f
- SHA512 e5a24d6e7a3d73c882b6cd7c305bb93beee8745c5f359fb53f949624827f9cba0eec2cd36f596130df3274f2c3a35a83b5b6b5662b5db52c6cdf7167d316056a
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QY:CcaClSFlG4ZM7QzM/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 869a8ec312acbe5122414aa944624362dea9577379b9809396d4d92f90a5d551
- MD5 945e500a1dae30a157212abad3f4199d
- SHA1 664da84a6e66636d04af7a299ad68d34b554d858
- SHA512 945733cf7bd8f286338f3014599f85835d9ed6973d9dfaae316e0669532e2c816de2b1f5435c0ffee419abd782ef77ee5ad78ec273439892363ce24a353d7f19
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Q/:CcaClSFlG4ZM7QzMI
- MD5 SHA1 SHA512 SSDEEP