Analysis
-
max time kernel
125s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
29/03/2025, 00:10
General
-
Target
672aa1917fc0e2b6573a2e133c0471ea2166f65d06a16d4d35745d5e3c150ed9.exe
-
Size
745KB
-
MD5
117693e11a24c6ede9ec1d9df7c25be8
-
SHA1
0183377986b7608eaa3998e6098354c73772e49c
-
SHA256
672aa1917fc0e2b6573a2e133c0471ea2166f65d06a16d4d35745d5e3c150ed9
-
SHA512
812ec76cce0ef203e65bf94f9e6b550f4f98ad5beab88df05157a2f67d10ae8b7afeb5c047cec29a5ad63062d34c04a28e93bc546ac7e871428bb5149b20571a
-
SSDEEP
12288:I5fftbKFi/se+UmC7v98vzokOa4zg8NGJlcgxSSXTetB+EcvACuV0o:I5fl+I/VH7v98vzokOacUlwSXC+EcvAz
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
VMProtect packed file 11 IoCs
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\672aa1917fc0e2b6573a2e133c0471ea2166f65d06a16d4d35745d5e3c150ed9.exe"C:\Users\Admin\AppData\Local\Temp\672aa1917fc0e2b6573a2e133c0471ea2166f65d06a16d4d35745d5e3c150ed9.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exeC:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD5de8ace08c54d964f6828781de2bb9c83
SHA1a10ad1ccffa403977b263b625cbee4993260d9af
SHA256d6d9a50a109f2243042dc7106af0d7297db4eddb8a26c3db54e9ba6a3b8b5be7
SHA512d33970a8c40e71e0cf3bce9063e826b4bb8d5c6af0f907fa43e13bdc474e8f926d6c2d81a392d28f61aebe4ce91b6847a1ef9f64148c5ea252c7c32ae4e2cf68
-
Filesize
753B
MD5132061ba9a95393acb5caa356ca12e72
SHA1558d20ac55b3ffa05deecc9473d691276e5e941e
SHA25687958b20dfb1d4aa02a27219962c367b5bdc002a1a52e6f2a3075952967cf418
SHA512000a454231b9e406eb23d25be48f3a0e728680078103127cc4e1c88cea5f8256cfad894e580487f6ace4abae27c9ce027a7b50325f2f81a6749479e62757f85e
-
Filesize
745KB
MD5749328f37d69acaa2c7de0f40facc4eb
SHA14bae557fc42c1b61ac5db3f1e0c0346692cde391
SHA25642bbb2716f311a9bd6387ef49395bd0ad1a341ecbf099fc0a66a624f48a09c89
SHA512ed25db1a1a12cfd772d6156d878c091bb62e99ef202eb51bffb0e6bf046def1ef535c613f0a4bf920db1c4c07efd2bd15c5171bd8889bcc9afbde1459f959d24
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB