b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563

Analysis

max time kernel
144s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe
Size

1.1MB
MD5

ded76a6f092e6fd217de29502edc7ef7
SHA1

f6ee795dc099d5a96876a4ddfbf802772d10df61
SHA256

b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563
SHA512

89dc5518f06018f5a933ad771eaf8cbe6106bc901ae00a4771540f1ce422aff6cf3c386ad2616c754681dc157b49d11c2713894ed2def26acf709349d97d90b7
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QO:CcaClSFlG4ZM7QzMF

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe
3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe
3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe
3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe
3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 4628	3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe	83
PID 3728 wrote to memory of 4628	3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe	83
PID 3728 wrote to memory of 4628	3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe	83
PID 3728 wrote to memory of 5092	3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe	82
PID 3728 wrote to memory of 5092	3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe	82
PID 3728 wrote to memory of 5092	3728	b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe	82

C:\Users\Admin\AppData\Local\Temp\b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe
"C:\Users\Admin\AppData\Local\Temp\b67c9b679f1b5447d97e22763cac41412ffd273c93a59df30451d20a0b53f563.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5092
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
83c4ed09e3d96630d3676de80baf642e

SHA1
2e2a486309daa3a08556aef85bd59de0cf509550

SHA256
31af646acc438e4f7c646eea6442988412b18580944edbc36dae851419e9f751

SHA512
a5da13bf295c4da7e5d26e31ac87c135ef3b33d8f7e3ff4b298cc7df95a8f131199bfa4ae52dc12a3956e1c47e5fccf2979443aaa4fd08f660d0e6d83789ff67

Download Submit
memory/3728-10-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download