90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe
Size

1.1MB
MD5

1f48cb19269ccb2b6e5221f1ca5eed34
SHA1

b70d75d4a36acb6db035cd54000444d5e46130b3
SHA256

90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede
SHA512

ee150233b0d9e855998da77848eb20e1132a697b187ce0d8f00d513bffe490f16bee357c0a0655d37f8aac45924d90b415b23ac05e05f5dd2138beeeb2b91c55
SSDEEP

24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QO:acallSllG4ZM7QzMF

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe
2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe
2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2900	2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe	30
PID 2280 wrote to memory of 2900	2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe	30
PID 2280 wrote to memory of 2900	2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe	30
PID 2280 wrote to memory of 2900	2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe	30
PID 2280 wrote to memory of 2132	2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe	31
PID 2280 wrote to memory of 2132	2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe	31
PID 2280 wrote to memory of 2132	2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe	31
PID 2280 wrote to memory of 2132	2280	90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe	31

C:\Users\Admin\AppData\Local\Temp\90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe
"C:\Users\Admin\AppData\Local\Temp\90270bb404ae9241f80a415402e5a454c3125df2b068babc52149afe054fcede.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2900
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
a7f39be18c667e5fa819a99ce89230e3

SHA1
21cef02b5f4318a2df4853b0b2cb4c4ca0d33959

SHA256
047f6451b5446a8de5beab8cc99a74dc70e0a65e6dcf94af30c709a8ed171486

SHA512
c2b6acf8c36c8e3b74efcb1562ae49527ef914cbef19565c4de40cdc6f2d555fb64e7e59f7b575661c6da3954933a963164f28fefb41454971c1011650984955

Download Submit
memory/2280-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/2280-12-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download