e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd

General

Target

e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe
Size

1.1MB
MD5

5af8a22abbe69ea6f9d58fbe2539df03
SHA1

c7b6372ade2c49c05d2d8f1c6ff485b037ef2975
SHA256

e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd
SHA512

669eae2daed261ba549a3527601ec8cc1c3241a967a348db91006db9616ac395cbcab0221a66d969cd6cb5384f632bb24cbf1da186bbaf88175668f2b067868e
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QB:CcaClSFlG4ZM7QzMy

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe
3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe
3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe
3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe
3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe
3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe
3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3568	3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe	88
PID 3584 wrote to memory of 3568	3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe	88
PID 3584 wrote to memory of 3568	3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe	88
PID 3584 wrote to memory of 3176	3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe	86
PID 3584 wrote to memory of 3176	3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe	86
PID 3584 wrote to memory of 3176	3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe	86
PID 3584 wrote to memory of 1652	3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe	87
PID 3584 wrote to memory of 1652	3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe	87
PID 3584 wrote to memory of 1652	3584	e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe	87

C:\Users\Admin\AppData\Local\Temp\e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe
"C:\Users\Admin\AppData\Local\Temp\e14a7cb76ed8bdad9bacefedfc4901afd5e56cd9d187e43aa1798cbfd0e34afd.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3176
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1652
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
9ea6ef2aec441ee3ae29313461c3cf8f

SHA1
097105bacef3e49c7efc5c70099625b6b81a4ed9

SHA256
a0941b1cf574fb71ec28c3e4308f5f7222029ef8c8796d05c2caded91620bd6f

SHA512
a3d7668269cdde0f2c8b034a47efe377dc3f771ed6ecf48943f4f62db0828618d6b4e019ad4308c126d28cf6bce85a5fb3c435e59b0d040d7fcc5c699139484e

Download Submit
memory/3584-12-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing