Overview

overview

7

Static

static

3

03ef87b96f...d9.exe

windows7-x64

7

03ef87b96f...d9.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 03:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    03ef87b96f49d1ca8a840aab50aa86911c456c2c6732083cba19f081c6086bd9.exe

  • Size

    1.1MB

  • MD5

    5cc6479f4e8a92cbce28bc874eb89aec

  • SHA1

    1eac482a5e8b0032c8760d09ebc3c31d8a423392

  • SHA256

    03ef87b96f49d1ca8a840aab50aa86911c456c2c6732083cba19f081c6086bd9

  • SHA512

    51230994615f82b9305554ad75dd281dd9305e6e7d554b9d3edea522f189e35e6def9010ee2df3a0aa67b9d4e26b56af979c01b883899b6c8450ac11e065d3d0

  • SSDEEP

    24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Q1:CcaClSFlG4ZM7QzMO

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03ef87b96f49d1ca8a840aab50aa86911c456c2c6732083cba19f081c6086bd9.exe
    "C:\Users\Admin\AppData\Local\Temp\03ef87b96f49d1ca8a840aab50aa86911c456c2c6732083cba19f081c6086bd9.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4988
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:924

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
          Filesize

          753B

          MD5

          7f73d2bd760238135d5b907f533efaad

          SHA1

          d15cd7c2f0bfa3818f84b8129ea4d4a1be30c40a

          SHA256

          11106c8f3b05daf08eaff504fd42f2bf2f486f2a7749c56bca1dccfaabea0c7c

          SHA512

          353a8441b0ee836a0ca2863e7301aa6fc000e02c12c185b79e6c3679d062ba72bebae5d755376caa1a94498b891c8acd2b8a9f2aff33bf112511012eee8b4688

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
          Filesize

          1.1MB

          MD5

          a3fd70ad3adecd86013081d2d7379522

          SHA1

          74cdce7f154c60ff576c89f1df692e133462422b

          SHA256

          e5f399bde5cab3755e3c4bd710d3eed8cb93c118a35bd7f7ff5e720f438570b4

          SHA512

          20627823e1ccfb2b9d09efd6eb6c7c60f57e68bdac0b8075e39444ad7a4d46b78fdd294f86e46742a623dbe6584c525429c14147a96cda1a8778bb44c5456580

          Download Submit

        • memory/2644-10-0x0000000000400000-0x0000000000551000-memory.dmp

          Filesize

          1.3MB

          Download