e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe
Size

1.1MB
MD5

bd621ce42c293aac7a7170a3e41aa44b
SHA1

19c4cba074a2893cad7bf33d81b3cb25fe129571
SHA256

e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8
SHA512

b64d893a39b5a272d9e588e8353585f12ddba0a8ba8ef2cdbae82aeca84cec97773c0d13562bc7eb2e0f8d097c39828f9b98fbd8ac12e4c6d1d9a4b9be23ae48
SSDEEP

24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyR1:g5ApamAUAQ/lG4lBmFAvZ1

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2144	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe
2144	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2144	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2144	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe
2144	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1916	2144	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe	87
PID 2144 wrote to memory of 1916	2144	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe	87
PID 2144 wrote to memory of 1916	2144	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe	87

C:\Users\Admin\AppData\Local\Temp\e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe
"C:\Users\Admin\AppData\Local\Temp\e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
5aa20b1a190e0c529e213b2ef03c11f4

SHA1
b237b345db9bd76567baa59fbcc1b12211866b20

SHA256
ac74e115701f7a6089fef2b8bf8fada72777ee41f905ea2df24c1b54ca2dec13

SHA512
ba0ed43d45c5fa534324550df6bed0b7cb9d794859ed53eea2eef6ce94025f6dae6286bcfb91fa82585ffe0085d898a6afc35f1163c0df0f165ffdc594f23bfa

Download Submit
memory/2144-8-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download