cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9

Analysis

max time kernel
134s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
Size

1.1MB
MD5

5987d3df499f68f6eae09a7637e53343
SHA1

5aafb46bc7a33b47358ae523fb2a878160154e43
SHA256

cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9
SHA512

2b42ad5b08c42b5c4f66e14914a1c821ccb0e4310276c8fceb4a908f60474e102979e9a761c372023252c97d0c7e34557f3b473bd83c496af43047224804f61d
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QK:CcaClSFlG4ZM7QzMJ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3408	4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe	83
PID 4312 wrote to memory of 3408	4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe	83
PID 4312 wrote to memory of 3408	4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe	83
PID 4312 wrote to memory of 1236	4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe	82
PID 4312 wrote to memory of 1236	4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe	82
PID 4312 wrote to memory of 1236	4312	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe	82

C:\Users\Admin\AppData\Local\Temp\cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
"C:\Users\Admin\AppData\Local\Temp\cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1236
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
c74948177d4a7582ce865498b907f2d1

SHA1
f4d24c7c64ec6abef01f8ac7eab464f4c77cbeb8

SHA256
e09692765e154f96be0f32288a21410deac20174ccc4fe98e59e96ab94dfecd6

SHA512
7d6bc1192a71b58234f3ce9382f724791269b503456579998a1c02271b9d39fdc25535c3c2fd82e25a2c3ce355ffe5c611352679109fb8026ab59dde64a1ad3a

Download Submit
memory/4312-10-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download