f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe
Size

1.1MB
MD5

241677d672cd0706ce2ebca58c1b18a6
SHA1

67522236fe75b2e62020c076658f7f4d27b60a6e
SHA256

f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78
SHA512

2d1069c10000bb4aa51d19898cb2573d80506819624bdaba73456360cec2dfdff4922957b18efc2b888eabd980d4909be06f8dc035ac927f414fb668e1ae7a44
SSDEEP

24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qu:acallSllG4ZM7QzMV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe
1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe
1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe
1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe
1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 944	1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe	86
PID 1356 wrote to memory of 944	1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe	86
PID 1356 wrote to memory of 944	1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe	86
PID 1356 wrote to memory of 2500	1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe	87
PID 1356 wrote to memory of 2500	1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe	87
PID 1356 wrote to memory of 2500	1356	f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe	87

C:\Users\Admin\AppData\Local\Temp\f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe
"C:\Users\Admin\AppData\Local\Temp\f6f195946eede97da8ef7a008311d5fc82f2fff722020cc7e82525a1b0108f78.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:944
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
19d76cb5366207410a6e82cb8390283d

SHA1
ab9593d67375c11662067bf18e5c7603a1dfbc21

SHA256
2f9abe84df4f85faff124149a1fe859523467959f637c0a64b72073bca7d43f1

SHA512
e93cf0a6bdece3e994283a19abc1cd2150e5c802192e7641364e18aec8753ace5b053eb1fdf592b122636b9a993d3c0822fb5e9d1fae47aeaffe3025a8460542

Download Submit
memory/1356-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1356-11-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download