c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
Size

1.1MB
MD5

cddb0982d0a85bde761e49a41506446e
SHA1

013e58c1e4f7f7298e11164444180385302ddbd3
SHA256

c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb
SHA512

4d6e15eb446ed0a240962c5188f7829f3068adb27f89fd6bb30f47ce16df2835cb36ab65add26062d4d9446024a10cc28d91a95bda26286e7f8ffefe8d0ad897
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QZ:CcaClSFlG4ZM7QzMK

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4304	3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	83
PID 3556 wrote to memory of 4304	3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	83
PID 3556 wrote to memory of 4304	3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	83
PID 3556 wrote to memory of 3260	3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	82
PID 3556 wrote to memory of 3260	3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	82
PID 3556 wrote to memory of 3260	3556	c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe	82

C:\Users\Admin\AppData\Local\Temp\c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe
"C:\Users\Admin\AppData\Local\Temp\c0b7aa96ee282a5b4ca2eafbb9eeded5ee7da3ee88bc4b422db0a13748d1d8bb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3260
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
4536525e2b96218ce5be7a4a41feb6bc

SHA1
43567945ca6f8ca9ac26edaacd5c2d81648c4a9a

SHA256
213bbca2fe063b2f74ab8595f050262efd9cb4040887e73329be36800043b89a

SHA512
fb1b6931f6c3d1941d93eccd779562df8515d8b378cbff6d61d7aebfdbc405549c7a538c197b39121255f0c204368e00fc55d18ef70154a2e74ff8850b03af8f

Download Submit
memory/3556-10-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download