Analysis

  • max time kernel
    117s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2024, 10:27

General

  • Target

    6e7d0ed3b46c8d0fe79c0cb8309600c04d28b1846990d2addc48e58c797588ebN.exe

  • Size

    1.3MB

  • MD5

    23d0ba89b4f4f13a84f971538087cef0

  • SHA1

    7e6770617f557f1a610d5c028601084dbb1d161d

  • SHA256

    6e7d0ed3b46c8d0fe79c0cb8309600c04d28b1846990d2addc48e58c797588eb

  • SHA512

    772104451184784ad2c034db833fcb23c7cb350d11559ccebee6d4577e53400f9a08941cc86337b27c4e2d106366594cb360cf93c5e1564074579379d91172a8

  • SSDEEP

    24576:nAD3HRNtvJ2QY6ynjTdcpLmBtMs51aoflG4/iMtQkSNSFkeKvvvvLpphd7d8ddPp:nkpBs5dlG4/i0QkSoeeKvvvvLpphd7dM

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e7d0ed3b46c8d0fe79c0cb8309600c04d28b1846990d2addc48e58c797588ebN.exe
    "C:\Users\Admin\AppData\Local\Temp\6e7d0ed3b46c8d0fe79c0cb8309600c04d28b1846990d2addc48e58c797588ebN.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1052
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4708

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

          Filesize

          92B

          MD5

          0a09f354748324840a98a09a15172fb8

          SHA1

          41dc1d5cb5f99590ea7b83516be4ca616707932a

          SHA256

          31a81ee87f0c6987d56d48ccac000d92e2a4efdb6b2f84787e9ef420d9f91c7d

          SHA512

          f21a7c0f5f13285b5faa1fdaca04d15460d9b436eda4bb98a761bdb02b802f00c1c5727d84c97565891d317cd2dbc92ac370ecb8c248082a83a51558cd63bda8

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          754B

          MD5

          02c869d11dd3d594a128660ee4cedf9c

          SHA1

          0fa985c07c44e7803fa47c1508972dcf8e3b286c

          SHA256

          c80331bc02c9f6d9f0d5811863a7b5bee2810029c72de5ee50c821b3bdc10e00

          SHA512

          22eda3844cc4320eb9df3b04bd4fd7f7076c6bdca1e557635929154bda6cd5f83ca26ea1d0041b427e6738a2f1d60a002190c26170e9194d9d263a69fc057203

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          1.3MB

          MD5

          9fca337cf6fe723608c0bbd379af404e

          SHA1

          b56dd405334b097102ffa2b4158d1eb6a10d52c7

          SHA256

          7320fc0fff04016d800a6cc2523321f512235fd3ddd4f4857e69907608d475eb

          SHA512

          6fcd0775f83da7a558dd43917fd68224c5654f57158ac6856a88ceeb43a838ff04d36b1b22618c84ab4c3c2f201be655ff879a6379223c9e556da0e269f26d15

        • memory/1940-0-0x0000000000400000-0x000000000054E000-memory.dmp

          Filesize

          1.3MB

        • memory/1940-16-0x0000000000400000-0x000000000054E000-memory.dmp

          Filesize

          1.3MB

        • memory/1940-19-0x0000000000400000-0x000000000054E000-memory.dmp

          Filesize

          1.3MB

        • memory/1940-22-0x0000000000400000-0x000000000054E000-memory.dmp

          Filesize

          1.3MB

        • memory/1940-26-0x0000000000400000-0x000000000054E000-memory.dmp

          Filesize

          1.3MB

        • memory/1940-29-0x0000000000400000-0x000000000054E000-memory.dmp

          Filesize

          1.3MB

        • memory/1940-32-0x0000000000400000-0x000000000054E000-memory.dmp

          Filesize

          1.3MB