cb3cadab2fb10a7bba918d8592ffaa51007af7f016d613c7eb1c8f56b3a4720c

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8737768___19082024.vbs
Size

611KB
MD5

a1cf972afaf33aa98391ffef7e12de6f
SHA1

42e4d4f227d57e1ccc6f033b06e160273052c8a1
SHA256

cb3cadab2fb10a7bba918d8592ffaa51007af7f016d613c7eb1c8f56b3a4720c
SHA512

6434776e5d364b51345d95a78592907e906eece1bec07b25ac1fb713602eaef5ff3f645b34fb038d99c1d811ca789a397bcc211a9f653e90c38a4bdf53eed0c4
SSDEEP

12288:BRp1dG2o3ZGJBMR1w21E7ea4+Ijet80vibbxMHGgd3xJUcVCE:7dN+4krucpet80a5MrGcVCE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2824	x.exe

Loads dropped DLL 3 IoCs

pid	Process
2824	x.exe
2824	x.exe
2556	x.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2824	x.exe
2556	x.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 2556	2824	x.exe	31

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\logorrheic.ini	x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2824	x.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2824	2140	WScript.exe	30
PID 2140 wrote to memory of 2824	2140	WScript.exe	30
PID 2140 wrote to memory of 2824	2140	WScript.exe	30
PID 2140 wrote to memory of 2824	2140	WScript.exe	30
PID 2824 wrote to memory of 2556	2824	x.exe	31
PID 2824 wrote to memory of 2556	2824	x.exe	31
PID 2824 wrote to memory of 2556	2824	x.exe	31
PID 2824 wrote to memory of 2556	2824	x.exe	31
PID 2824 wrote to memory of 2556	2824	x.exe	31
PID 2824 wrote to memory of 2556	2824	x.exe	31

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8737768___19082024.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
405KB

MD5
82445b614a19b6dd8b0cc300df368fb5

SHA1
00bbc0ce4c476a3808fa94257c8b19d72b686c61

SHA256
419f5936bb164413541c97966c9074e7f20e49949f005f94c7800784245c6ffd

SHA512
05c5d04e1c2d0cd32ee0a3c284466d23156e2fdb64de1d54b15e73d53e2ec2012340c7f56b7e2e24bae01c01fcbeee7698b62e5807f7f6c50191be99f8d53279

Download Submit
\Users\Admin\AppData\Local\Temp\nst319D.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
memory/2556-22-0x0000000076F60000-0x0000000077109000-memory.dmp

Filesize
1.7MB

Download
memory/2556-23-0x0000000000470000-0x00000000014D2000-memory.dmp

Filesize
16.4MB

Download
memory/2824-19-0x0000000076F60000-0x0000000077109000-memory.dmp

Filesize
1.7MB

Download
memory/2824-18-0x0000000076F61000-0x0000000077062000-memory.dmp

Filesize
1.0MB

Download