Analysis
-
max time kernel
98s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 21:08
Static task
static1
Behavioral task
behavioral1
Sample
9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe
Resource
win10v2004-20240709-en
General
-
Target
9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe
-
Size
1.1MB
-
MD5
8239e4b1405d8b7855048a00f079a1ad
-
SHA1
b976d994d476075d5dbd5dec6c3bccad1002af66
-
SHA256
9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c
-
SHA512
e0ec149b46de6776cfaadb8e929caec9aa518d92902a8eb58760f17a0d6b310640c951ba2cffd026522c9271e8225acf7dc652d0865e55d63e643c20461cc36f
-
SSDEEP
24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Q7:CcaClSFlG4ZM7QzMM
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exeWScript.exe9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe -
Deletes itself 1 IoCs
Processes:
svchcst.exepid process 4668 svchcst.exe -
Executes dropped EXE 2 IoCs
Processes:
svchcst.exesvchcst.exepid process 4668 svchcst.exe 1988 svchcst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
Processes:
9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exeWScript.exeWScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exesvchcst.exepid process 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe 4668 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exepid process 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exesvchcst.exesvchcst.exepid process 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe 4668 svchcst.exe 1988 svchcst.exe 4668 svchcst.exe 1988 svchcst.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exeWScript.exeWScript.exedescription pid process target process PID 3012 wrote to memory of 4128 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe WScript.exe PID 3012 wrote to memory of 4128 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe WScript.exe PID 3012 wrote to memory of 1536 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe WScript.exe PID 3012 wrote to memory of 4128 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe WScript.exe PID 3012 wrote to memory of 1536 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe WScript.exe PID 3012 wrote to memory of 1536 3012 9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe WScript.exe PID 4128 wrote to memory of 4668 4128 WScript.exe svchcst.exe PID 4128 wrote to memory of 4668 4128 WScript.exe svchcst.exe PID 4128 wrote to memory of 4668 4128 WScript.exe svchcst.exe PID 1536 wrote to memory of 1988 1536 WScript.exe svchcst.exe PID 1536 wrote to memory of 1988 1536 WScript.exe svchcst.exe PID 1536 wrote to memory of 1988 1536 WScript.exe svchcst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe"C:\Users\Admin\AppData\Local\Temp\9d8114e44f2e383298e097c1a53671df65d99c48ed610d704922ada5a85a6b9c.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4668 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753B
MD5745eadc6f954c2ea1a3460534d587f81
SHA1e4a2bcf773316f39fae0b0131fd53d3369a95adb
SHA256d4268b1ec86e27679d8a1e935b9c7bb7f7609c013e8e6fd156d073bdb649dab0
SHA5128d85306fec1c25c46ef9ee5aa0d04f72fb9786142e7cbe45bb22a40b4781e46edb3d760f070fc4435442da1d65048c8c49607712ee30f53535a91ca71a0724ae
-
Filesize
1.1MB
MD523a38fc6d1e526f8967ec68bf74ab761
SHA1c72ca6d618f4fc39bae41dff2758252ba883881e
SHA256df6d120f589e4310ddae4769908a57b27adcf479f3e0df5d22da0170db7b8e56
SHA512bcbcf4a03886b9fc0a055dd378eae6eb966f80843fbac35d794eda130c6549e85961b6ebf97e0bd8efd0e519ad47b4a55df8e4551e989f976f651ebb8a3077e3