Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/12/2023, 04:56
Static task
static1
Behavioral task
behavioral1
Sample
b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe
Resource
win10v2004-20231215-en
General
-
Target
b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe
-
Size
1.1MB
-
MD5
b8a5583e033a5078b919cd82115ed3bb
-
SHA1
7f9307aa4c0e99204ca594e5b07dc11c4446d3a5
-
SHA256
b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1
-
SHA512
fb292aaf107894815dc5d2269a30d2de97aef7fcf297aa2050b641f1126f21c7fcfe1d9db5f9c6552edc6bf8ec2ffd03e8e98238ef32e98040cdea994be90241
-
SSDEEP
24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qz:CcaClSFlG4ZM7QzM0
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2800 svchcst.exe -
Executes dropped EXE 24 IoCs
pid Process 2800 svchcst.exe 2860 svchcst.exe 1984 svchcst.exe 352 svchcst.exe 2836 svchcst.exe 1848 svchcst.exe 1564 svchcst.exe 2256 svchcst.exe 3000 svchcst.exe 2656 svchcst.exe 1336 svchcst.exe 1668 svchcst.exe 2904 svchcst.exe 1928 svchcst.exe 600 svchcst.exe 1828 svchcst.exe 2488 svchcst.exe 2796 svchcst.exe 2916 svchcst.exe 964 svchcst.exe 1980 svchcst.exe 2500 svchcst.exe 2716 svchcst.exe 1312 svchcst.exe -
Loads dropped DLL 34 IoCs
pid Process 2932 WScript.exe 2932 WScript.exe 2660 WScript.exe 2076 WScript.exe 768 WScript.exe 2120 WScript.exe 2120 WScript.exe 1756 WScript.exe 3036 WScript.exe 1612 WScript.exe 1612 WScript.exe 2088 WScript.exe 2716 WScript.exe 2296 WScript.exe 2296 WScript.exe 2448 WScript.exe 996 WScript.exe 996 WScript.exe 1960 WScript.exe 1960 WScript.exe 1972 WScript.exe 1972 WScript.exe 1520 WScript.exe 1520 WScript.exe 1540 WScript.exe 1540 WScript.exe 2780 WScript.exe 2780 WScript.exe 1336 WScript.exe 1336 WScript.exe 2044 WScript.exe 2044 WScript.exe 3024 WScript.exe 3024 WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2800 svchcst.exe 2860 svchcst.exe 2860 svchcst.exe 2860 svchcst.exe 2860 svchcst.exe 2860 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1712 b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe -
Suspicious use of SetWindowsHookEx 50 IoCs
pid Process 1712 b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe 1712 b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe 2800 svchcst.exe 2800 svchcst.exe 2860 svchcst.exe 2860 svchcst.exe 1984 svchcst.exe 1984 svchcst.exe 352 svchcst.exe 352 svchcst.exe 2836 svchcst.exe 2836 svchcst.exe 1848 svchcst.exe 1848 svchcst.exe 1564 svchcst.exe 1564 svchcst.exe 2256 svchcst.exe 2256 svchcst.exe 3000 svchcst.exe 3000 svchcst.exe 2656 svchcst.exe 2656 svchcst.exe 1336 svchcst.exe 1336 svchcst.exe 1668 svchcst.exe 1668 svchcst.exe 2904 svchcst.exe 2904 svchcst.exe 1928 svchcst.exe 1928 svchcst.exe 600 svchcst.exe 600 svchcst.exe 1828 svchcst.exe 1828 svchcst.exe 2488 svchcst.exe 2488 svchcst.exe 2796 svchcst.exe 2796 svchcst.exe 2916 svchcst.exe 2916 svchcst.exe 964 svchcst.exe 964 svchcst.exe 1980 svchcst.exe 1980 svchcst.exe 2500 svchcst.exe 2500 svchcst.exe 2716 svchcst.exe 2716 svchcst.exe 1312 svchcst.exe 1312 svchcst.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2932 1712 b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe 28 PID 1712 wrote to memory of 2932 1712 b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe 28 PID 1712 wrote to memory of 2932 1712 b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe 28 PID 1712 wrote to memory of 2932 1712 b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe 28 PID 2932 wrote to memory of 2800 2932 WScript.exe 30 PID 2932 wrote to memory of 2800 2932 WScript.exe 30 PID 2932 wrote to memory of 2800 2932 WScript.exe 30 PID 2932 wrote to memory of 2800 2932 WScript.exe 30 PID 2800 wrote to memory of 2660 2800 svchcst.exe 31 PID 2800 wrote to memory of 2660 2800 svchcst.exe 31 PID 2800 wrote to memory of 2660 2800 svchcst.exe 31 PID 2800 wrote to memory of 2660 2800 svchcst.exe 31 PID 2660 wrote to memory of 2860 2660 WScript.exe 32 PID 2660 wrote to memory of 2860 2660 WScript.exe 32 PID 2660 wrote to memory of 2860 2660 WScript.exe 32 PID 2660 wrote to memory of 2860 2660 WScript.exe 32 PID 2860 wrote to memory of 2076 2860 svchcst.exe 33 PID 2860 wrote to memory of 2076 2860 svchcst.exe 33 PID 2860 wrote to memory of 2076 2860 svchcst.exe 33 PID 2860 wrote to memory of 2076 2860 svchcst.exe 33 PID 2076 wrote to memory of 1984 2076 WScript.exe 34 PID 2076 wrote to memory of 1984 2076 WScript.exe 34 PID 2076 wrote to memory of 1984 2076 WScript.exe 34 PID 2076 wrote to memory of 1984 2076 WScript.exe 34 PID 1984 wrote to memory of 768 1984 svchcst.exe 35 PID 1984 wrote to memory of 768 1984 svchcst.exe 35 PID 1984 wrote to memory of 768 1984 svchcst.exe 35 PID 1984 wrote to memory of 768 1984 svchcst.exe 35 PID 768 wrote to memory of 352 768 WScript.exe 36 PID 768 wrote to memory of 352 768 WScript.exe 36 PID 768 wrote to memory of 352 768 WScript.exe 36 PID 768 wrote to memory of 352 768 WScript.exe 36 PID 352 wrote to memory of 2120 352 svchcst.exe 37 PID 352 wrote to memory of 2120 352 svchcst.exe 37 PID 352 wrote to memory of 2120 352 svchcst.exe 37 PID 352 wrote to memory of 2120 352 svchcst.exe 37 PID 2120 wrote to memory of 2836 2120 WScript.exe 38 PID 2120 wrote to memory of 2836 2120 WScript.exe 38 PID 2120 wrote to memory of 2836 2120 WScript.exe 38 PID 2120 wrote to memory of 2836 2120 WScript.exe 38 PID 2836 wrote to memory of 784 2836 svchcst.exe 39 PID 2836 wrote to memory of 784 2836 svchcst.exe 39 PID 2836 wrote to memory of 784 2836 svchcst.exe 39 PID 2836 wrote to memory of 784 2836 svchcst.exe 39 PID 2120 wrote to memory of 1848 2120 WScript.exe 40 PID 2120 wrote to memory of 1848 2120 WScript.exe 40 PID 2120 wrote to memory of 1848 2120 WScript.exe 40 PID 2120 wrote to memory of 1848 2120 WScript.exe 40 PID 1848 wrote to memory of 1756 1848 svchcst.exe 41 PID 1848 wrote to memory of 1756 1848 svchcst.exe 41 PID 1848 wrote to memory of 1756 1848 svchcst.exe 41 PID 1848 wrote to memory of 1756 1848 svchcst.exe 41 PID 1756 wrote to memory of 1564 1756 WScript.exe 42 PID 1756 wrote to memory of 1564 1756 WScript.exe 42 PID 1756 wrote to memory of 1564 1756 WScript.exe 42 PID 1756 wrote to memory of 1564 1756 WScript.exe 42 PID 1564 wrote to memory of 3036 1564 svchcst.exe 43 PID 1564 wrote to memory of 3036 1564 svchcst.exe 43 PID 1564 wrote to memory of 3036 1564 svchcst.exe 43 PID 1564 wrote to memory of 3036 1564 svchcst.exe 43 PID 3036 wrote to memory of 2256 3036 WScript.exe 46 PID 3036 wrote to memory of 2256 3036 WScript.exe 46 PID 3036 wrote to memory of 2256 3036 WScript.exe 46 PID 3036 wrote to memory of 2256 3036 WScript.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe"C:\Users\Admin\AppData\Local\Temp\b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"10⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"12⤵PID:784
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"14⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2256 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"16⤵
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3000 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"18⤵
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1336 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"20⤵
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1668 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"22⤵
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2904 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"24⤵
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:600 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"26⤵
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1828 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"28⤵
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2488 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"30⤵
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2796 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"32⤵
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2916 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"34⤵
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"36⤵
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"38⤵
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2500 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"40⤵
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2716 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"42⤵
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1312 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"44⤵PID:484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1928
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"18⤵PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD567b9b3e2ded7086f393ebbc36c5e7bca
SHA1e6299d0450b9a92a18cc23b5704a2b475652c790
SHA25644063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
SHA512826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
-
Filesize
753B
MD5b4b0a35a27754471bd4c0737c8a4ed65
SHA1fef3c44530313b03d9ec49ff6522428d6a4c2c85
SHA2560e58c3d8ebf0a7ccad0c5af90962806a2e09fd7b5f34a85004d5d35e5571ba65
SHA512a250032e020ce62c1ebc2827dd809a7486a693291c711a0d4d70b4d4978768a078a5c81fee96dc11747c7fdd945bec6c06fccf0b4fc48135a71f8ceaf1c4f9d9
-
Filesize
696B
MD5e0e0a1f6d22e3905753a9c1ed053cbff
SHA152c11b8049f4015d7825fc1fcbd0d5eadb29a6e4
SHA2562eca9ba67f160c00268003e7239f9cfc5da0f10b6a0b3c82538ef2a0874b871d
SHA5123eb98287cc8115cb648626272eaa6cc77cb57fcd614f0e969d3af3977a8e09e0f7f6f3ee6ef9322e096bf0cec546f681a6983030a10e972b538d42e2bd17740c
-
Filesize
696B
MD5faa8ef2e758448ccba58a486794e0699
SHA185bd05023b75335ca0ff084efcd02e7e9e447e88
SHA256f4c0222febb3104b66ec8578be36697e28bc8956d3606e711c39b3ad7fcf6b8b
SHA5128a1074670bbf7942ba1cef24d474aa26b9a66c378cc790a5577bc3d487f7174dad7890d2fdd43eccad42c4da28e282e5909a8f9de120a3ba81ee2847b44a328e
-
Filesize
696B
MD5fb757130836576e5f952cb011021776c
SHA168f6351ef6dd363f67e76b91e7d8150050948698
SHA2562d8143967be00cc4d6f3a1b8671885498b80e57ec52a84e19eaf136e64980e5b
SHA5126f7311c6964be509733152377344d37f311021a6638946d275d282aa1b0212d8d790175b8c4e61fba6f5f4299c0e5da3307b69b03f619273462edd5c3cfce0d8
-
Filesize
696B
MD5463784728a0ab2b8cc52ee1ed0e5258e
SHA1620a618c31439d36e8539e50359713befcc28e92
SHA256a34e1ed304dca4f58275bdd5daaf071d1767db7bb7ccc6bf2aea2df5e2be023b
SHA51252f9736297fbaf65179d35e01c7a15d516d2ff8b5c949a45046bc668bbe94b5da63aea4d5920ebfc1a884721f16fdcae75ea08ca9a6aa78297a44051ed979c7f
-
Filesize
696B
MD5e5bba46683440caa1508061b6e638120
SHA1538ff5b7cb3ca90cee3e60bae0b487f4b78912de
SHA2569b324dbd185a14c0ebfd2cd2731f6bb32c501dfefa7aef4f65b137357502c65d
SHA512466f00fee10e323273e5d1151062e9fcc36f5657a404c6dd3c0c9ecb56e5205930087e612b13a9c6d1a56df7e05a2bd9c14e95debd5e5aed96ad2ef867e8de4d
-
Filesize
696B
MD54d8de8aafa7849de2f40f61eb205cc42
SHA167decea42f8c2ee805e859a898922c90ae105cdc
SHA25644a2def2aab8221d4302282a111d1b9592b8828363736aa27a3343836817d2e2
SHA512a44c1b2e8bc3b432daac94073c22e3b93ee412e345f4b2037586fc178fc7909f9360c2ba0817d7648d0739aabf51c6533e87226bffcd7109974e561d901610fc
-
Filesize
696B
MD57a01dad1af2b3e0327e1d352436bbcd7
SHA110612930777b11e8edeb9bd33c74a6a2404c9d6b
SHA256185fe22d4d1af7aee3fd8cf94dcfe20c5daf320764d2c96c2ad5f2cff4cd1655
SHA5121fee128690213b1ffd6c1f95d9894f52c2b0374ca99b16795028fab6b364298c1d678c3f92775c410c0fe7a1a71a33d3db5635e5bb6c71449feb60c9f5316616
-
Filesize
696B
MD50297693238c8d2753940dd61243ddfd8
SHA1c5e61e727061ecb2475cfd052102d1ec3f837ad8
SHA2562c553c736dbf82875ba83b712b4d0a0e5b63b0e4089f0882755bbf078c22c0a5
SHA512042527b1ea8d7e3cc25f8cc72c357e39ef822e78eb9c5802613ff806f9869fff49e63ebd0d8e52754c5a918fd76640dd0bc7a1a1dfd5e82cecfcfcc13c8579cd
-
Filesize
696B
MD56cc9dd78b42e2ca0e1deb237988b6ae2
SHA16ec16a7e43a4c558a19f125758d56ed9a180e6ee
SHA25611367ac6f6a1b237ca69aeeb571a435181256f8836d6910f036beb90e160f7b2
SHA512331f0ae896c0fb9906dd2fc2e3d58860073af97deb31cdb2184cc4bd104e2e066bfec6bdef0e16a8eda3d5605875fe7c03480b1e2d68bc9d7e3a2b237a3020a4
-
Filesize
696B
MD52551ae733b39ac9061a9d5ebd2f29d98
SHA108247d27dd5bf959db0b29d3e5b0551dc47c9d02
SHA256c69ee4a632cc1c351d5fa930d42546923a4125e7d9cbccb2ad9f9e3318be2b77
SHA512a1c669cb87194c2b496a7131f7f2920b6c31156f88d6c1140e79f3b83fbca3785cd57fea2d47cb951ed576e69a1240e81746a5bc5444e65fd05fa5234125731c
-
Filesize
696B
MD5298f56408ef5bfe14b938d85e57c843d
SHA1691d78c4c4887333b4679d3e340a7a04caad13a3
SHA256b5738b726b24c9d220bd7256e4abb2e97215d50416bf67983cc82dc83b46298a
SHA512227bf6d7e70568144112dc142ef60fa38f2b5f39196e3d3377a120b78fa86382726021f024bf5413548df0ce1734bb905d28e56de4dd80c6f21c05ab2a5ef83e
-
Filesize
696B
MD575b8f60cfe6895a93f2d8f1b5568af94
SHA1b80485bc82864b4e1bf0bcc44579eaa01776b1fb
SHA2566ff47f7681e8f497470bd11b2cfd8156c5d8f1b01f48bfd89037cc4bfe0f34cc
SHA512089e237c5309d36058e036f69d78deb4144749e91b3a8a8383f817af051a3452acfdf42227cc721517e93428cfd5d48b42e9750e9548762609e81917a4de29c2
-
Filesize
190KB
MD5550498355386bfac99bcf1c96151441d
SHA197025ee359c1afe428afaee75b5fcc877e71c64d
SHA256ecb1ce83da0f1324a5bacb405b3bebb420508590231da0995635e4448f7168ea
SHA512da904c6030212ca9639bc072af21307ae3a46f0cc104dde80e6fca7136256b3e0f71de22b5837ff7b64d2b5da4e05aa55957d2a73cbde49a9aa053c9db95d251
-
Filesize
428KB
MD5134a2f3221fe9357ef66e7f7b1137de9
SHA18a396d7243831842e245ac2bcf94894db6daafd3
SHA25607c615e0c6fd569ade0100cfce58020b05a235037fb47b8da710257dbd2f5f63
SHA51280b0bbf908c4d6c047978bbd266ad67c74dedbc8c10e950421de90df2223eeb7dc7fbbfaab1a35fb43639a1a5b1430150c486b30aee7c864e13135fc38716fe6
-
Filesize
471KB
MD5a31e50f33d3efe148d344d59f85c5bf5
SHA19a724737f39fd6dfb4b6974648026a421a1984b1
SHA25601052567f0896338a76acceb1645fb97c26a36fe91e664c014eff6f244a008f7
SHA512ef807090f9a1dff4f2363470fbd251adbe9f32e53a5450349f520e351f4e111be29eef502e1e90397e88d0f2dccf86a6f7d8cf0a45d10668908b07f2f243673d
-
Filesize
532KB
MD5a7fafed2b41a648a8c9040ca0909a827
SHA1918efdb698d64c26136607756ca601b99148333e
SHA2567da069133002d5406cf43448275410a459592bea8c1c16996544820552ed41d0
SHA5127150eb21976369d4fd469d7ccb097699bce61b415563d432ee326a662f6d1fca3cc0ed5f74edc05a0b8957d18162e64a3fea068a523ee8bdf2936dbc0834cb86
-
Filesize
237KB
MD57d3d0cd8ced4b0cf510b4b2ced595ceb
SHA16b081ac60011e915f3dc9ec400325f0e293cf851
SHA2560bad6c0d14e5171d21ee70ab1e16563b7d5e89309cd229ec46c089e054bd63cc
SHA512f05f414b709672f0e7b5cc6b6e054ae5ac11d74dadae6ba3d022b9d346ff8cc05b992d61b4c1e826f0520fde2f47160db5b5ac43746475b2ea301f30414fb8e7
-
Filesize
157KB
MD52ec9929548b3360b3d1e57e6940c8b81
SHA1cec0e01a94182c3997b16fbb596c72bb9d46db14
SHA25646e3114f5fa4051a05b1b2cd0d01811460440643a1237418942f6681066e7b42
SHA512ea0b2149993dc468289e89d7c7b724bb13183539374ae82b02c6f66f6b302e9d0a170a2a7d4f01b74bbec1cdc76a45a6562879bf78dfcbaf0b1fa3fcce24efeb
-
Filesize
370KB
MD5f62acd9219bea02bf22051e33490a309
SHA1d0a761553ac3a451168494c412174e640afa1667
SHA2566e077721051db9d08ffe0fd8e4887fee43d1cf33afcf8d53b82ab2f3d867b35a
SHA512a5de79b3f57588e460a856e647c307eb19f1379fd0500c0a8aa33af788d91a1b6f840a5efacfc82762a29f89febede9203630f38b1ade6adb87aaa00001ed281
-
Filesize
303KB
MD58fb3876d6661ca0d4e4ffa26cc2c1b01
SHA147a828dd513b43e5bb880cc1580474f76cb769c2
SHA2569155c5dc090007293e2a747b35a68d7255f5785feed436aa6d74a66ee46f79b8
SHA51259aea62e5bf22cf4d02a05450f21348a54492cb969a00ea5c4aab1748bcde4698a5a81d8e7b06c62afeb3f2dfbac9f52e2ca23fd20d22c98f2c2406a54cd3dce
-
Filesize
302KB
MD5b989ae35a5572fb942d5d93403634497
SHA18d41d33d15e600096f2d8efc2a6dd365fb5fca64
SHA25690a770fbf3a92efb53067a64203834eef7ab63363a8989e9972e2c80b49a6854
SHA5122bb0e962869bc5ea4e38463f6ba2c4d0c26e346a0354c8efa449552072fb13fd6decf21ca65dcb2b8b955eecda1cb300ddbeee59746372a6994cde37a6e5e8af
-
Filesize
260KB
MD58c2d28c3a61209defb73cc2fb9892bb2
SHA1644e25af4bb7b9e9f501f1c4695970eefb5db860
SHA25648d60b6df7d0029d568dced0d192981817be098952999b6def57a76d0f758b62
SHA512a0f77a8a5e9ea601672ae87a5a7d30935fb6a677875165be46de689f8acf300ff23da1ef932ad86d847aabb503185f6a776b8de467d1ee6edd6220d886969cb6
-
Filesize
258KB
MD5717a0ddd3c9c0ec3b1e2fbbdb5c48288
SHA161418e90b6e1264a04bb1a987aa30a831bc375b2
SHA25674608f78b54278ff515a77a6189d0f652502e3b56bbe0d4a68ffdb1d1cfba818
SHA512bdca45c8607e5b04b5e27fe8f619f668341e74f5f3cfac2c28d26c61780bb2eb38ef42217d10c8a061daac8601e85e7aea9963af2eb82a8605b6c917347d37c5
-
Filesize
400KB
MD519d4b1874c0e5164e25dbf42d7d321ec
SHA14321478d641389ed17d452124aa77199f58a89e3
SHA2569f797a0907cf8de64012f3b8705e2d4d620ad86e0991ffc49a8f432047c98942
SHA512832365b8dd415ed27d7cd618dc66ef8e74a9f58fa4315f4bcead85e87d9a2503f709f785faededf03b66d21045ae5ba81f1bef7e7c29d9a6ac94676f7d99980d
-
Filesize
460KB
MD513a1ef34c62da9a881e6fe1ec08185af
SHA13ce7de00be94c835acb0a1ef75090a4b602b83d4
SHA25616e59e1d22c8c4188e7ac04ac581ca6d26ff42c9ed6529d2ff28035d8c6d1b45
SHA51229b7eaf199d2f220a8517d613a1a3fa10c90bded257dc57dd4a92d239fce26812c4a8af67c2410639fd180cab23a6c12b099c92d118aa77749db955b6337ab9f
-
Filesize
600KB
MD5a03aea97d869d270393028e3c49d1c75
SHA173f83670e6db7478844b49cc71d13e2814ed425e
SHA256261c0f2e33c87e08d2b91e94bd6621f05a8709b4dc9c467511dd6bb5eaf27594
SHA512da08b70cb334f4742479dd3a1502fbd076c770c09a98cc5895abe79c81a6627f138589a84e0732b1df06398875e5e04a419e81e49a6b63c897c94a85d7232603
-
Filesize
443KB
MD58ee8162fbbbf668da1a852ea916d3020
SHA14bbd75ce2e21a8beb1a22bea3e4e73d9356d821f
SHA25645d10a7e6f0ad6ab233bea110bf82bb2c56e392162a5cc4f11cdb2a5f0b5fd1a
SHA512931a95a0822d5be3f7798cf58692716f84c46890442c95767d1b6fa29a8a9cac0f1f8ee939314d67d2e0122a1d346e3d4304803c09d4a256bb41e4dae29bf58a
-
Filesize
298KB
MD571ad10d4bda79c3baa67eefd1c933160
SHA155a5728a9cabfb69f13a47dc9ea8e244d0a38028
SHA2560c805db903bc8dc60f51e9326f87b14ffa8671ebd691956f203bb6db910ca11c
SHA512f7793a0d2f8933aaff19f182a0dc84027847107b7ec5c166aded7167a9dcb357c9bf0aa6b954ff6a0997e2a8113fb3bc2d60e92400c5ec81d0816a6b71be18b4
-
Filesize
163KB
MD52fc5308315cc359c7a0288c82d7c792e
SHA1948959085499b606bf91187baf59ed743bb96684
SHA2568f34d3e1e62e56fd5747439ab4b7ce6d624545e665705c98d5a02f8fb52863eb
SHA51214b293687d99b46c86e1a15afc021153aebc1c816a55411d98abf8b38af78c15a2f8f0ffa81d390c2bb2c549b408d9395d856de35c728a6f4968edc9b110d79d
-
Filesize
448KB
MD5c63fce96e2ce896cfe1da02f3a5481d5
SHA15af39b2d610ef9c459cb6114938a0b75179c7382
SHA256cf32bb786ed5523c06a21b7fbc44823e96179c7316649c5879ee9c853640685a
SHA512ee1db71918ac288ff5f288d3e17472102e44965136e70dc891e68b7e9c8ba8e45f9dc1c8a1fef2d99dffd5a67f05f7cb17336c71ab6bdf09ab13c195a54fef7c
-
Filesize
191KB
MD595d30c471f3ffed8fbc861b790e6b3d5
SHA111f120dec1ab9fb302c392ce95456890652da54f
SHA2561929c14c2dd65bdf36e47f92d79060446bb8688e6464de0fafe3a4284294a958
SHA51269e89773fefaae8377bbc4b81be157738b029d3e102ae845d96933b3a98e0840707217d3f1fd982c61cfffdaca91fde2e41b06a230275893eb85a057e3c49fc0
-
Filesize
325KB
MD5f9d7a91c7c66caa09d1707f4572c6b0b
SHA103f65cca8f359e92118e6b1651f55e76613ebee9
SHA256b2c95fee44cc36f7f3870dac775851f374333669becaac90543fb0a4ce35a169
SHA51276fc6894bb57b3b26138f350f6a4d59df009f58bff04ad07117a4e34437087c496837c908dd65c2414a6d274b3892e9471ddc24907cefb0b698370b0fe4304ba
-
Filesize
104KB
MD53f7a0e19ac9f1d7e2e7e8fd5f6254410
SHA1a989ae89eb5ac219da7319cf3efe0c3c5b9a8fc0
SHA256335d95f0526a581dfb3a91056aa4e0d3d679fdf41999168b722c182df2b5b2e6
SHA512e91b7feadaffbba4d33151c4d8fa9572afb973484d0fea797bdcc1ec12ac7bb950ced9cf4a12bfd6885c6c577789a3ef8f1c2b22a59e065119a95cbe9ffd6016
-
Filesize
414KB
MD5d4486787b58b23c80df403949b9ac42c
SHA15db265b2155250bd4d38a17063dcc3da24a45afe
SHA2565b99114a787d3c05e4465aabe560703e2986c51183ca25593a8dbacb65c9bdd0
SHA51219ec0c2355637cc69173ab9e03f2b6880e741c04c7b53df23e0fd6a5afbeaaa93e2d63d072580cb09e8919086fffe55be3d4efcfccf16fed83f26051e6161e7b
-
Filesize
896KB
MD57a4f41632753226eefd2438e628b53f8
SHA167f178cda2ea2cafd1a1bb43c4feec0b08757d59
SHA25664eec299d04a63f574d531297fb123c2e8b3f334e6ca95127907d48aa3104104
SHA512033a11fe67f04eeb46d698d6be69f07b7dbf5eb223cf5e28fa813de769b543aad3d9136b88fcbb8637a6ecaf311e771c6d49a32a4c57c4ec5148854d4c4bd918
-
Filesize
336KB
MD5e3a83e7f0d7f88065d2b32326924e758
SHA122080ceed03c82f6bb71b7ca67b6e4580d453717
SHA256a35ad215a864e85ef328b75b1732fcf58f168ceba2fff72b81edcf48531f866c
SHA512a8451fc0a17810e8a362d2df3616f7e874231d096609818720a2c13c960ee69b7fce90968e6bfc1c1d72d5ea41a66f9c5290eec522e2d97e66d6ba53b7fbfe98
-
Filesize
1.1MB
MD5cbec7ee1ec900d406a3bf5dab648751f
SHA15c0e06a632683378ea15c117cb4a607556b8167d
SHA256b0f5135751469f210066157e7a77cd03ec3baefe3098f84ba993f754005589ed
SHA5124641bdb3e69d3f23e729c994fab0cd0b0296ad808a237c3ed0dcebe7f178e12ecfa7fd525614fb3957584d248f2dcedd080beb1eddb168975ecd9b69492fc57f
-
Filesize
154KB
MD59ef79ce332b3da85d6d91cf1e4001d2f
SHA1685a06db12da913ba7dc748f5b6d83e55171374e
SHA256ecab786b083f4df7329e108bd934a2be05a64ee791f046cca58d1b16b7ac8993
SHA512ec600d314b385a09421a96daf17182374ca7b64f50cd446e6c0e1f4eb5e551e51b55ff1886c2964df901840c00d6b4d4278e36b52fc8ba71ffbcdf2ab45c93fc
-
Filesize
269KB
MD5f1757a7bf2f1d0b042edb909d548edaf
SHA1c331a18aeafeb001349d1fd2f518ac786f80aaa7
SHA256f254b58f36e5451dfc32cc3da3d4fa8ea7d5f4429a55bcabacd9a5243e1096d7
SHA51250f00d3e6217dbfba394eb2946ae1a76670f7bf2d4c3bd9ed9a4a2b4dfc8e21bbb790583f2a62962f8e8ccb6c3084455a58b652d9b9a380a363a411385718448
-
Filesize
366KB
MD56fb4904bea5714a8bc811ee6c0279446
SHA1ec40017aa624fdf5c03fb89b1e81d42dcdbeba79
SHA256b8e26da3c808f50b39261648d6cd7fdb5fdb43c2f2b1faaf41613ec4b0e03abd
SHA51235c54948e8381a169e6c3240081c6164aba5e8abb9b76ddc4823047d088b48416e1c66c94420aa478451f902f1325331b5cd9f51de2db613bf47e17a7d2d7122
-
Filesize
241KB
MD5c374020bbdb94f46cd12bf14f26cf26f
SHA1c41d9281ec2a662fc621b917b5d936129e76469e
SHA256d77f8e8c6d53df9ab3fc6fb4fe68bb975a8555eba776d3e459a8db7ec78f5af8
SHA512a00068e02298d8ea078fae5fcd76ad6c7344e28a65bb79697b8aa7c2d250a47a4c41daa27c922def79cc60a1b3b3cc08d916faa6cf8a0842f636eb52cfa978b3
-
Filesize
231KB
MD504818d336852fdbdc97caf08ce965a5d
SHA1c2822e321b178ccc2d146cf2ace5a1bac69c2e33
SHA25696441ef67e0d30f841c1f516d02a9c545ef1dd7ca2b698c0532b33f333d28454
SHA5128fbb636a05640cbfd9d1222c5b7dc095b279bd1a53eb9a22689110f7a2fea5361ee715464ce21bb3b66f418fcff0610e2722bdfe9da70d46fab5f71a3cb01767
-
Filesize
281KB
MD5266bbd86667a389d7c859db84201969c
SHA1b304640bb440984df64550fbd62fb734131ee7b5
SHA25688e53f1968fca0610aa290e0321875921291ebd5aa6c7a0f208e1a37a7c8b989
SHA512caaa70191d9b55ec0f7f4bf8ba78bf18b778c8382d8e1707fe4c7c67ef74ea4529c28e2b6a5d4fdf3e16c17a2e8ca70cd47e2a76b75183ee5eb98b4dd3a78d7d
-
Filesize
480KB
MD59b294ad6ae4c2b6e84949534b8096afb
SHA19d0728cb5197a14838cd2882e132e5865fee4bc8
SHA2560c87f7c8cedacbfd942be7d87140db1890b8f14c346d7aac7f585753c5f9c264
SHA51214ca48e5bdcac985a269308994c460a3cab72e8692dfc62a776f4eccc75c96a2b3eeaed157cb1891493106b75a739771e398a118f5302d9660795e42b1ba9ca1
-
Filesize
959KB
MD55287648716e7a42d894985882d7c2407
SHA1a202773ae1c420204adbb6abd28557b2d4bf2fdf
SHA256def45996867f64e805a0aab8cc5d06cc333fe41c0bd04a3b59b20e134de71441
SHA51233792b8a2af1736734139d2222d439ee49e922a5fa95234e396198bb51cb07a4402e58fad685e97e4730ad22fa439888ea400b520e1bec30f2a3df2a35c395be