Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 21:22

General

  • Target

    769e6323132b15d38c798a79b37f6f02cfcbb5fe07850488a73e7f5e295fd38a.exe

  • Size

    1.1MB

  • MD5

    5ae005ab8e33040cc8017bf3d7cd4933

  • SHA1

    d84c18cacfaca10d86ccac1c60d40a8e99032370

  • SHA256

    769e6323132b15d38c798a79b37f6f02cfcbb5fe07850488a73e7f5e295fd38a

  • SHA512

    0f68b324d33cf8ba088614d17c2c1c39a5d147cdedd6790b5eb5b00257c169041ce8a82ebcbc4e28d5cc99591fcd36218395eb82b9998e20efdd08d00765353b

  • SSDEEP

    24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QN:CcaClSFlG4ZM7QzMG

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\769e6323132b15d38c798a79b37f6f02cfcbb5fe07850488a73e7f5e295fd38a.exe
    "C:\Users\Admin\AppData\Local\Temp\769e6323132b15d38c798a79b37f6f02cfcbb5fe07850488a73e7f5e295fd38a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    753B

    MD5

    e18424a722e75bb65cec32105eb50c3e

    SHA1

    8863739f7fc5109f6b63ce6d89436096b502ea50

    SHA256

    f019e9fec1c600be596f5877851a7c491aadb28991a25541331cdf2f2cf21b77

    SHA512

    6965d9ce9061dcf6da40057b155c1c93cd86f5361c9ee06fc60e38194787744dc8fc3a426e7cb75436d38fb00063a9c4ff31fae55a327d620c3af3137d442be2

  • memory/2080-8-0x0000000000400000-0x0000000000551000-memory.dmp

    Filesize

    1.3MB