Analysis
- max time kernel
93s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
12/07/2024, 21:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe
- Size 1.1MB
- Sample240712-1fv22stcpb
- SHA256 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c
- MD5 4c5dcd9938042aedf62b99ab4167c249
- SHA1 e36c383d1c9f66cb4ee613bfff6140cdd5f724e2
- SHA512 80b936eee7464eccc5f42b982bf21ee4cee7a001e21f392aa4b9899aaeaa31fb50111b546bf5e75f888d7f9bb481910b22164ea346d29b6895e7c665134e3c5d
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QL:CcaClSFlG4ZM7QzMM
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 4364 svchcst.exe - Executes dropped EXE 2 IoCs
pid Process 4364 svchcst.exe 2384 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe 4364 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 4364 svchcst.exe 4364 svchcst.exe 2384 svchcst.exe 2384 svchcst.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2796 wrote to memory of 4040 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 86 PID 2796 wrote to memory of 4040 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 86 PID 2796 wrote to memory of 4040 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 86 PID 2796 wrote to memory of 3876 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 87 PID 2796 wrote to memory of 3876 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 87 PID 2796 wrote to memory of 3876 2796 5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe 87 PID 4040 wrote to memory of 4364 4040 WScript.exe 89 PID 4040 wrote to memory of 4364 4040 WScript.exe 89 PID 4040 wrote to memory of 4364 4040 WScript.exe 89 PID 3876 wrote to memory of 2384 3876 WScript.exe 90 PID 3876 wrote to memory of 2384 3876 WScript.exe 90 PID 3876 wrote to memory of 2384 3876 WScript.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe"C:\Users\Admin\AppData\Local\Temp\5564060957ce386319e4b100fea9f66b91685ebfff68877de3ea061dc360164c.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4364
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2384
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 ddae1138ccb68deecc6c9ac4bf7a2592a29fb971095f425a60725ee697f63fb2
- MD5 8c905c053f666d97d3223d381b6ca21a
- SHA1 d9960e15260a3fe2096b8962c2ab30004b19aade
- SHA512 f20c983f99580258772a79ada4dc79f0cc4ad8a561eabfb2bdc6cd29f3b9b893815df7a94fe4c3019c51a8c3169cdf2d5fd6ed8bce20c6b89e68df6adfd37b1a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 664555dd0492d4678d076a0fbd56c044ea295957d27f3b896fbaa8eccf88e0ed
- MD5 65c864161ea094245221f84517d8f4d4
- SHA1 65178cbec7109f0b1d757d06f32b4738b6639815
- SHA512 84d05885d1366b9907db6d91e186c388d8de2260a05b56e721581e1b26129402d7a856df23e66945dd9ea7f60d996340a4e33b80445277631bf6e3f2f2399525
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Q0:CcaClSFlG4ZM7QzMD
- MD5 SHA1 SHA512 SSDEEP