Overview

overview

7

Static

static

3

06bda8faab...16.exe

windows7-x64

7

06bda8faab...16.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    130s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 20:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    06bda8faab5e6f8460bdc18727fc12a323dde150d98f41b1477ac365df47b316.exe

  • Size

    1.1MB

  • MD5

    c95f845b3532906893538d13876898d0

  • SHA1

    d505c9dcd00a99ac0bfef4528cf3c8d41df10c07

  • SHA256

    06bda8faab5e6f8460bdc18727fc12a323dde150d98f41b1477ac365df47b316

  • SHA512

    48026292cf126cc1f58d548764ef39aae72af5881b0f6e801de86cde0f05271c44b05a10f10da9609e968d0e38a675c8908e111b4148816ba9febbd7401e20e4

  • SSDEEP

    24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QY:CcaClSFlG4ZM7QzMf

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06bda8faab5e6f8460bdc18727fc12a323dde150d98f41b1477ac365df47b316.exe
    "C:\Users\Admin\AppData\Local\Temp\06bda8faab5e6f8460bdc18727fc12a323dde150d98f41b1477ac365df47b316.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2792
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3600
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4128
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4360,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
    1⤵
      PID:676

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
      Filesize

      753B

      MD5

      4de80dce96e5e0fc06782db2373e9418

      SHA1

      c0de072d0aba139864e70ed688377051b9163c42

      SHA256

      f673ec1c9cdd167b33f249cdc22be2e654631ae96dba53871a6c6a8103855237

      SHA512

      e873e157d5e9809634ec2be35a4a09a3aa6e1ac7f247560eaf98146aa7f156ffe0a8f8bc277420e6a7a236739e9a1a4cccbae3ee7f41f43fcf8001e21878cb43

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
      Filesize

      1.1MB

      MD5

      7d4f92eae892bb3a6fccaabf541929fe

      SHA1

      c3109b6bb90c807c7a89e7c26ddf4148aae79d21

      SHA256

      326cbc72372ea23a36626576da3aa6bbd78d38a524b257f0c46c8e2b862a2ce6

      SHA512

      ba1817356255f63f9f77347d5c67012c84af1d8aff82498dfef4aa9ab06960ef652554d03ce140ede795c1f8f4f1c42fa80428c8d4f1446d561662ac29fc3a64

      Download Submit

    • memory/224-10-0x0000000000400000-0x0000000000551000-memory.dmp

      Filesize

      1.3MB

      Download