b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3

Analysis

max time kernel
87s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe
Size

1.1MB
MD5

17536f11d85da81559bad70cf48e706c
SHA1

252433418c85b8edbd1c71bb05a899fac1180878
SHA256

b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3
SHA512

bb81175f227b7886fd35b4d45104c6eb706a01a15a527c54e1252f05992f4fa8d1e05ae6c6bea8750db5d4fef393e16641110fd1db4c694552f1300f47330b4c
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Q/:CcaClSFlG4ZM7QzM4

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe
4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe
4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe
4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe
4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4348	4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe	87
PID 4584 wrote to memory of 4348	4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe	87
PID 4584 wrote to memory of 4348	4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe	87
PID 4584 wrote to memory of 3676	4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe	86
PID 4584 wrote to memory of 3676	4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe	86
PID 4584 wrote to memory of 3676	4584	b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe	86

C:\Users\Admin\AppData\Local\Temp\b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe
"C:\Users\Admin\AppData\Local\Temp\b00cb3b60bacc1ecc6ee4c2e0008b9de50e65f002971460d3bb54e4fb0f1dbc3.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3676
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
2910992da847dcb10a327fa1904451ec

SHA1
a316db1f491c5ffb17cdcf6c89e95689b33fee35

SHA256
7299f779bfaf36be0e72ce13d7971b9756fc1a8da17d9ef0b262d43f086ab4ca

SHA512
6b4d82989d5323a22bd881c98c8736476f39f096a8d9ff3104d89c99b397045f7bce6f7c13549e062b55e1d4cbf22204dc335c2cf49845f04319e44b45747634

Download Submit
memory/4584-10-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download