Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/09/2024, 11:01
General
-
Target
bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a.exe
-
Size
5.6MB
-
MD5
9c3e3e209ceb90dfd938d2601ce97f7d
-
SHA1
3d893e8b945857d157a1012c0849b2e085e63fe7
-
SHA256
bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a
-
SHA512
b45ac76adeb70132ce8df800645131ee7dd3c43b83fa72557d7d32ccfffb7c97e0800d42743449f024b6f6431ee2fbcb02c974dc9ee77111c9cdea7dec21cd15
-
SSDEEP
98304:ExeeHncufaoTlD8AOrXQ9UR8pzePsAOmUevOshs0EOQC5oqYITMzdhHHQ82a:ExHffaoRD8AKQSe+sGUeFnEOQEofz/QQ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
VMProtect packed file 10 IoCs
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a.exe"C:\Users\Admin\AppData\Local\Temp\bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD5b93e4dff6366cad398fa944fe30bdc48
SHA1156056d76954122703fd8bef8624c4513afc0a56
SHA25626d2948e0475bbfeb8fd453cd5c009401a79580f07f04e0b268a867f790672ee
SHA5122bdfe257925bd5f56b8e60d971424fc50f38ab90f2adecf16bc58790765c9997b3c9e8e7224fe0ef056095e721bcd5c62e1c2d7aa1c4ed537ae63acee1c4e174
-
Filesize
753B
MD5e84dc6ed8a1092c01ff0f60b457c6b3b
SHA1bca67bf351ee825c77b29c1a68352f906801ac79
SHA256ba8e24d2f60135e0c5be12e247d5604e9e78bcf2d67c17455a5b713a0b8df047
SHA512942a764420750980d6f3d666ba2af39a0e2482ec205fe792ddc944db45f33be67bdb3e2320535aaeff39349ad1e2a5e05c935d5b4f4bed43ab373e04ca3d029e
-
Filesize
5.6MB
MD58079167c7497655f5ebd7846dec2323e
SHA18779a5455bdbc7bd42d9347ec3b1bbc48a80630d
SHA2565673db27f1bd085d55c3d3bae81e1005c67d46981db6775f49a57472731fdd31
SHA5125a8e4a0c5f164c0da4ea8717a8d6672b4a499ac79ca097763ebdf312035eb5e291cbb4ac7ddc597746a9f705bd92c9c668a3bf9c09c78a3ba99c4446aeeb2622
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
3.3MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB