eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe
Size

1.1MB
MD5

59780d2692570b1f51c4149fe5c7a688
SHA1

19ba3fa2887f39bb568e71da2af8a1174fab8b28
SHA256

eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4
SHA512

c65e2dc2f50bc2847d0f5740c8fac69aecfb369bedcc0a6b4a47e1e17d72b46e28da4827b1ca64779a2927d111174467495483ddfdc4c3402ec370ced03faa62
SSDEEP

24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qa:acallSllG4ZM7QzMp

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe
2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe
2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2816	2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe	31
PID 2764 wrote to memory of 2816	2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe	31
PID 2764 wrote to memory of 2816	2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe	31
PID 2764 wrote to memory of 2816	2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe	31
PID 2764 wrote to memory of 2388	2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe	30
PID 2764 wrote to memory of 2388	2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe	30
PID 2764 wrote to memory of 2388	2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe	30
PID 2764 wrote to memory of 2388	2764	eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe	30

C:\Users\Admin\AppData\Local\Temp\eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe
"C:\Users\Admin\AppData\Local\Temp\eb08189d31b4dafa9bbd2edf25cb05971f16a2771c8194be2546a746e8677eb4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
67fb9b36f0498ee29c00371c53a562e2

SHA1
60453598a53a925602a050805d256f3741998ea1

SHA256
4b235e2b8ad88196b5eaffd65d2d1321daec29334d5317bf41189fbfcd869828

SHA512
93a470cb6b812462ab923f345bda765328099ce3dd87fe00f3f6c1f72f00c630e169a5fc55a704d53789460fca2ed58e1b67f05e04c003242ff6e188bbf2f7af

Download Submit
memory/2764-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/2764-11-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download