62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 01:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe
Size 1.1MB
Sample241110-bwtrgswfpr
SHA256 62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e
MD5 f21ebe9247a419288286bea06e3a0022
SHA1 dc19412632a0f57e3605a83f710b1935f56a9d09
SHA512 60237dc5baa968b06a77c4046b50fe54210487b7f2f98d388dde1fa6e96d4056abf38ee4935b75e40965eb4d36dc05f9897673b4ae8189aa4abf7e89e8ea4819
SSDEEP 24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyRO:g5ApamAUAQ/lG4lBmFAvZO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe
1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe
1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe
1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe
1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 3316	1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe	85
PID 1068 wrote to memory of 3316	1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe	85
PID 1068 wrote to memory of 3316	1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe	85
PID 1068 wrote to memory of 4660	1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe	86
PID 1068 wrote to memory of 4660	1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe	86
PID 1068 wrote to memory of 4660	1068	62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe	86

C:\Users\Admin\AppData\Local\Temp\62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe
"C:\Users\Admin\AppData\Local\Temp\62f0b136b066adbced8013072c96a9a0d3b61e64d98424086b02f7cb0c0bd69e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3316
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 a5f21e32d97722cf7d1611dbb39aa42d0b6fb5a6c4d6905c19e5ecf6037c3428
MD5 cf24327b9494cd6d85310275976991c2
SHA1 bc9e945da74f7e5747e2e23b81add5de978ae5f8
SHA512 0ccb9b97973037abda8239143f154cab3ece8db10b7b45a8396b77594c335e68f9e483dec1d3fccfd3c0221a7ebb570ba46d9377838be65a8d323c34cc93150a
MD5 SHA1 SHA512

Submit Download

memory/1068-10-0x0000000000400000-0x0000000000547000-memory.dmp

Download