32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe
Size

1.1MB
MD5

a1d8d460c3aea7b2b7c8242aa8da353a
SHA1

901b77b2e300a6c6a46fd48cf3fa4aa7468339f2
SHA256

32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf
SHA512

ac37ea1c63abe447be18953cd710fb3ee5505d810d7dc564081a437b15339e94b18195d87f535de2cf6fd7a164d57c5535c01335b268a8e27cb72d967722a5c5
SSDEEP

24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qu:acallSllG4ZM7QzMF

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe
4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe
4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe
4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe
4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4252	4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe	82
PID 4072 wrote to memory of 4252	4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe	82
PID 4072 wrote to memory of 4252	4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe	82
PID 4072 wrote to memory of 3496	4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe	83
PID 4072 wrote to memory of 3496	4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe	83
PID 4072 wrote to memory of 3496	4072	32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe	83

C:\Users\Admin\AppData\Local\Temp\32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe
"C:\Users\Admin\AppData\Local\Temp\32104c00261724ade56b3921c9a1b2af6c3e69d445dd8021495ae03b1a22cfaf.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4252
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
f8cccb5e5f5372e45cbf1dee825bb3ea

SHA1
8847df198fc37f656436fc9c401b73574abe011c

SHA256
02d2c9eeedbb0fbcee8199849b86baa31f8ad9e1505ada96583647af7ecbb211

SHA512
df88f760d4c4742a12a2ef6b5d143b564b9a362aca06d255fafab4caafd315e782d822c5eceff661b994ec54490ef7a62b07999a6de5cf0a9645ccc595dda494

Download Submit
memory/4072-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/4072-12-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download