eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8

Analysis

max time kernel
131s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe
Size

1.1MB
MD5

62b5006566dc1c5c7c69e6478aabd880
SHA1

2b089643faa572bbf41eda7afed4b6736e3a998c
SHA256

eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8
SHA512

8fdc31ca17300eebd6de0d93e6c294a7c909d9e6be4769dc4f0d10e6dad1a0b1b9e40018f3979032ed7956ace04a719f6299f7feab2e72abc4ad356f61db39a8
SSDEEP

24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyR7:g5ApamAUAQ/lG4lBmFAvZ7

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe
4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe
4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe
4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe
4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 1168	4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe	88
PID 4136 wrote to memory of 1168	4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe	88
PID 4136 wrote to memory of 1168	4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe	88
PID 4136 wrote to memory of 2692	4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe	87
PID 4136 wrote to memory of 2692	4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe	87
PID 4136 wrote to memory of 2692	4136	eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe	87

C:\Users\Admin\AppData\Local\Temp\eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe
"C:\Users\Admin\AppData\Local\Temp\eb08e852ea0b743d2531fd371b93803f769a5de38ba47d9e4bbca425fce6a4b8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2692
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
0740c47a1b0f4d041c1d8b28a8bd303e

SHA1
609dcff12e7521cbf2cf2a43bb6debdc856d28c3

SHA256
4d8341f4656ff0422bfd3e14eeec4b7707967a70cf801dcdd52a96567def3826

SHA512
ac90ea6417816869f6e58b8dab6838ebf128890aad26c5d4a7da4c47ce75f363186c2c9311725f02a50624eb75069bff00bd6e3b10f923fda3f59434dccb89e4

Download Submit
memory/4136-10-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download