c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
Size

1.1MB
MD5

cddb0982d0a85bde761e49a41506446e
SHA1

013e58c1e4f7f7298e11164444180385302ddbd3
SHA256

c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb
SHA512

4d6e15eb446ed0a240962c5188f7829f3068adb27f89fd6bb30f47ce16df2835cb36ab65add26062d4d9446024a10cc28d91a95bda26286e7f8ffefe8d0ad897
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QZ:CcaClSFlG4ZM7QzMK

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2744	2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	31
PID 2732 wrote to memory of 2744	2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	31
PID 2732 wrote to memory of 2744	2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	31
PID 2732 wrote to memory of 2744	2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	31
PID 2732 wrote to memory of 2180	2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	30
PID 2732 wrote to memory of 2180	2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	30
PID 2732 wrote to memory of 2180	2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	30
PID 2732 wrote to memory of 2180	2732	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	30

C:\Users\Admin\AppData\Local\Temp\c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
"C:\Users\Admin\AppData\Local\Temp\c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
a899f449e2d2ad4707c85228592b5eb8

SHA1
943fe92dabfba019d97c133ef95ddd7898ded26f

SHA256
fbffcfbf95960dbb18edb52cc330b192e44e5fdfeb3a100ba8ea15041959ccdf

SHA512
2ae75ef20714c1bda448f80b75b54bbb39570a1d49fff7a7593013a71962618823f4c91f11558e7938c88ccc40b7f63755552b6c9c016fb7c38eb65bc7932808

Download Submit
memory/2732-10-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download