fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe
Size

1.1MB
MD5

cf0cea1db3e9b9c2a4b0514194ff7d36
SHA1

f6a71050eb83cb8673c554cb6dfe38ad24e0844b
SHA256

fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0
SHA512

76a308f93bd3e7d2e384211a566a02ad4c284d2cf59a123356c3a191be15b299ed015bf9e0072c65b068a4f51aff18750dbf0db1c3977d8ef020ad811caa687d
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QY:CcaClSFlG4ZM7QzMv

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2156	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe
2156	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe
2156	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe
2156	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2156	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2156	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe
2156	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1580	2156	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe	82
PID 2156 wrote to memory of 1580	2156	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe	82
PID 2156 wrote to memory of 1580	2156	fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe	82

C:\Users\Admin\AppData\Local\Temp\fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe
"C:\Users\Admin\AppData\Local\Temp\fede9c004ed04680326300cd44ae8ca38b01bb3fd3d8e41907129c67b1ac51c0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
90ce140bfd90131a2d8034f2c0120d20

SHA1
90a48f5a2b480b019317997cafb9ea5baa04a6b0

SHA256
bfc88944773f9a7fe09b545577582f21d1ad756cb34840f72895e6179d3e693d

SHA512
b66b3aa4f1fd5374b9f760c560fe4ada6c9727948b133827e2b791561a116c1b4504b9a0fe8424b82ac46fd7f9c6c694bbf1f7acd9279fef8da9b5ac5309dcb0

Download Submit
memory/2156-8-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download