Analysis

  • max time kernel
    140s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 20:26

General

  • Target

    b31a3467a70050552aa1d5b24f19b97f3f8c95e2e0dbfe8223bd844a7c2da56e.exe

  • Size

    1.1MB

  • MD5

    8f63cd72fc0fd5bcbe8bf285d7cbb97b

  • SHA1

    8ff3a1147585ed7b23ffa817619cda109fb7cb59

  • SHA256

    b31a3467a70050552aa1d5b24f19b97f3f8c95e2e0dbfe8223bd844a7c2da56e

  • SHA512

    4025dec8792de3404f6c0a9ce76348fd124f6799f35d90129efab6ce5dd8c08e21b0ea33634807118d5a7a95978b2198d9a70d9a188faba38e5e365f9f522d76

  • SSDEEP

    24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QR:acallSllG4ZM7QzMi

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b31a3467a70050552aa1d5b24f19b97f3f8c95e2e0dbfe8223bd844a7c2da56e.exe
    "C:\Users\Admin\AppData\Local\Temp\b31a3467a70050552aa1d5b24f19b97f3f8c95e2e0dbfe8223bd844a7c2da56e.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3280
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4056
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4668

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          753B

          MD5

          9099770c53f4a1d270deb6091734caa5

          SHA1

          181828c5944babd227f8ad6482bec87d2ad4e5f6

          SHA256

          908a4f1000c1aabb9b97c92f5105236b4fecda832dc346a5acf8556dc06b0bcc

          SHA512

          678220226e08848d62a5f14301caa770c58072c43554393d1e67eff8c8105345793732b6181d83b47eecf4454995d9d44df2f588e0e2625d8fe1b8d54869bf27

        • memory/3280-0-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

        • memory/3280-12-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB