18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
31/10/2024, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe
Size

1.1MB
MD5

9dcf6786656a021b548c00ddcb0ed390
SHA1

cdeed74a80491149e6468bda44f319ba5b6f33bc
SHA256

18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e
SHA512

700021a7a3b05419c409b6fae0094a64c7f30927ac7a417e4c68aa0ec2423b9d9d52ab3127fb13ab9de0bbe447be0dd896b5a0cc3187d11bc3a46d1962934ff7
SSDEEP

24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyRT:g5ApamAUAQ/lG4lBmFAvZT

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe
2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe
2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2692	2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe	31
PID 2644 wrote to memory of 2692	2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe	31
PID 2644 wrote to memory of 2692	2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe	31
PID 2644 wrote to memory of 2692	2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe	31
PID 2644 wrote to memory of 2704	2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe	30
PID 2644 wrote to memory of 2704	2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe	30
PID 2644 wrote to memory of 2704	2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe	30
PID 2644 wrote to memory of 2704	2644	18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe	30

C:\Users\Admin\AppData\Local\Temp\18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe
"C:\Users\Admin\AppData\Local\Temp\18d652ce815fc72f9cbc9e490b866d0fec385038bf00d2a46b16d01294cd732e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2704
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
309de83f2b4bdc4a33d5969d879c50bd

SHA1
ee4d257f6392a4c060e1c84418a2d6286711ec99

SHA256
c4309c2487ffa44755dc0a880123736828b37872f750def60a04eee5b6d0d308

SHA512
e37d560c67bdfa9936fab4e5a3216871b9d9be34326d1ea680dec0a89232144ac1c76ca7d0703bc83ca2a9d07537d92aa977dba3cefd608dbaf221ff93683319

Download Submit
memory/2644-10-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download