Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10-07-2024 21:05
General
-
Target
c8e81b11c928d45eee32588d87956f0fab633a88c39c8efdb3a451b6e4351697.exe
-
Size
1.1MB
-
MD5
75cbf00b7c64a2a8240828c6696728dd
-
SHA1
88f1a5977e42da9824cc944b93b61a1b848932e0
-
SHA256
c8e81b11c928d45eee32588d87956f0fab633a88c39c8efdb3a451b6e4351697
-
SHA512
f8e7d835c7ba430578f6483f1638fc5c049c014e5fed2e39170ff2735c9e9eff6c165f4378b11127f03099e29728fa7e04645d4366695a416613ca294c2b499f
-
SSDEEP
24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Q/:CcaClSFlG4ZM7QzMo
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8e81b11c928d45eee32588d87956f0fab633a88c39c8efdb3a451b6e4351697.exe"C:\Users\Admin\AppData\Local\Temp\c8e81b11c928d45eee32588d87956f0fab633a88c39c8efdb3a451b6e4351697.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD567b9b3e2ded7086f393ebbc36c5e7bca
SHA1e6299d0450b9a92a18cc23b5704a2b475652c790
SHA25644063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
SHA512826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
-
Filesize
753B
MD53140f68850d425901dc5baa275cdb185
SHA18dcf810fe6699b629e4f1a8c6ed12f51f969c179
SHA25627e9eace4bfc861e62040065b94c1cbcfbf840ed92217703d00ac1951a08e034
SHA51210d0ab0b8651df7827ab008d9020a7ef6770e03b0fff0549d250600a34a1143074d1839f6dd667c87deeea3efca5f0fac3834dc35225bc0f846c4abd41e0f4e8
-
Filesize
696B
MD5e941c404604f780e37c7e63233301fa0
SHA1d27c9a3b90881add1a06b41b5931267fc818ff08
SHA2566add2531fc05662418f48a46f522fa4507053ece8d0d94a04c0c213d27da81ce
SHA5121f448e52f5aa81f30ecf10d6222fa0913ab7a5f3c0f2c7e6a9deb231e9bf55937c4fb0f84bbaeccdd9040e163ae371daec55eff48d633cd6d6bd409433fbf4f2
-
Filesize
696B
MD5423a0fabd3a9fd2cbedc3aba67c69650
SHA1880097557ac6718e93822ac7efc9a3e2986c51de
SHA256d77f549afde3b88ac747c3d0dee3069f914fac77b572ae08737ffc05f696491b
SHA512c65d3db8250c7885b05075ebc3485db4506dde6c435247ad6a86e9085d59b039f4629583b327662a2eb40c79bc135d5d17b5bfb01f63ee02726aa57ecd7ed139
-
Filesize
1.1MB
MD57b53983b129836c02db45afe1d9bc749
SHA114be63592963b5d28e01ff01c62a0eadfacda9ef
SHA256b5b5c900bd127b6fc6c18944ef74b875532723d17d25faec6e2c7a9f79f09aaf
SHA512b36fa9c0fc7aef71a32b8dd5b9bf57e9a2d15e676f09e78dd73cbd78ff8caedde014ecfcbc3d35660127995a0c5dbb2896c729c1a44f6ebfa135215d43fb7cd7
-
Filesize
1.1MB
MD523116c5bd2613630197a8e2c8ae44c7c
SHA14a65725852a4e4fa18bbe29efc6f0b6dc117c655
SHA25630660dd1ab1b6796e8a4b8f6edc76fcc9e973d9d20816275208e24156b3f965d
SHA51229fc9c870eddb276b44232ca4846d4c4cf1821c68950461b928d3555b1cfbe8012a6e01020741f110b58a16b333002ff3ab6b35f18da5f4793fa824527428576
-
Filesize
1.1MB
MD55b56e0453365f01d06ff01aefc4f2438
SHA19ecddfa3707bf55e41405b369f43b82b0a687044
SHA2565d6f57a5a47887ed0dc7b0fcd16eb23819824e641e9710d884e92cbbc618fac1
SHA5120c20fe9982c7802abfbc5c87566196b33a6094ff0fd9da24f0f300cdd6af8024f296a67240182f3d98076438b82b352d8e527061ec73a71890f658b454cd5c74
-
Filesize
1.3MB