Overview

overview

7

Static

static

3

cbad60cad7...cb.exe

windows7-x64

7

cbad60cad7...cb.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    131s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 21:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cbad60cad73dce60051ddfa91506c8f760de8c353658e8d13a548a9913fe5fcb.exe

  • Size

    1.1MB

  • MD5

    b2b1b4e832430b0add5c9e54f0584277

  • SHA1

    2ffb755079b573644d5f78ab50e5dd04bf5611de

  • SHA256

    cbad60cad73dce60051ddfa91506c8f760de8c353658e8d13a548a9913fe5fcb

  • SHA512

    36f30eb084cd6df78720ee7c6dc18ff273f01df7db694c98c7a5e6dd67b75ccc29550f30a8e08f4baf2f0fca2dae7e9c6600a41cd7d50c833eeaf25691beb660

  • SSDEEP

    24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qt:CcaClSFlG4ZM7QzMm

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbad60cad73dce60051ddfa91506c8f760de8c353658e8d13a548a9913fe5fcb.exe
    "C:\Users\Admin\AppData\Local\Temp\cbad60cad73dce60051ddfa91506c8f760de8c353658e8d13a548a9913fe5fcb.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:5028
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4444
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4988
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
    1⤵
      PID:4400

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
      Filesize

      753B

      MD5

      87feb2bb0d07e65a746f84447e52412a

      SHA1

      9eab43e9f456c3a2adf4f9274a42c5dda588ae8a

      SHA256

      5d33d6be23c480d5a3ec7f3cbad7280013dfd618399f0a76583965482fca772e

      SHA512

      ec0c988a977b41559d18d4f446d0eb59b972ef65a171446a943ce3bc666d0339e0c109e858368ebd991f6f579afc704a8c6251fe49d6e226e6fe5c2df81da468

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
      Filesize

      1.1MB

      MD5

      d8ca7a93eb0a9320be3345b67f392d8c

      SHA1

      fec1b8d71248dac54821736823a34c77967f08ce

      SHA256

      f42fdae1c30696bee7dee90132a6dac94021a5b6d2f586267ae5ce9bf474dcf3

      SHA512

      01f2daa3f607977374812dd5dea0b3cf3c68d230e4193c2a22ecde76f9343d1b940048c1a0129c219b73a739c1afa2a427ea1c36f6e3e068a4f1e5f402b03ec2

      Download Submit

    • memory/4664-10-0x0000000000400000-0x0000000000551000-memory.dmp

      Filesize

      1.3MB

      Download