cc756b37d620316333438196441d932dba6748092b17a162eded5ba4bb4689fa

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

969f133d61986ccccfdfc4c6f746b867.exe
Size

500KB
MD5

969f133d61986ccccfdfc4c6f746b867
SHA1

71075f4b24aafd1339627dee3f7531f12fe60938
SHA256

cc756b37d620316333438196441d932dba6748092b17a162eded5ba4bb4689fa
SHA512

8abadbb818d3d6e320f9df3e8b19e0322c30aa8d50701a7b5806f6f731558f43fec7c5c8acb8d59a1d80cdf95a5c5931926bb8df4841889ec2e33815b0d9e3eb
SSDEEP

12288:AggTl+IQtTDtW70TsVK5bfeaUmKcc7HIUriC:2lGtAdK5WaU4iri

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2636	vsc1.exe
2868	vsc1.exe
1076	vsc1.exe

Loads dropped DLL 6 IoCs

pid	Process
2140	969f133d61986ccccfdfc4c6f746b867.exe
2140	969f133d61986ccccfdfc4c6f746b867.exe
1076	vsc1.exe
1076	vsc1.exe
1076	vsc1.exe
1076	vsc1.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	969f133d61986ccccfdfc4c6f746b867.exe
File opened for modification	\??\PhysicalDrive0	vsc1.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.ocx	969f133d61986ccccfdfc4c6f746b867.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 1232	2040	969f133d61986ccccfdfc4c6f746b867.exe	28
PID 1232 set thread context of 2140	1232	969f133d61986ccccfdfc4c6f746b867.exe	30
PID 2636 set thread context of 2868	2636	vsc1.exe	31
PID 2868 set thread context of 1076	2868	vsc1.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\vsc1.exe	969f133d61986ccccfdfc4c6f746b867.exe
File opened for modification	C:\Program Files (x86)\vsc1.exe	969f133d61986ccccfdfc4c6f746b867.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	vsc1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Compatibility Flags = "1024"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}	vsc1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}\Compatibility Flags = "1024"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}"	vsc1.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\TypeLib	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Control	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx, 1"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\InprocServer32	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\MiscStatus	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\ = "Microsoft WinSock Control, version 6.0 (SP6)"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\MiscStatus\ = "0"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\InprocServer32\ThreadingModel = "Apartment"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\MiscStatus\1\ = "132497"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\ToolboxBitmap32	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\VersionIndependentProgID	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\ = "Microsoft WinSock Control, version 6.0 (SP6)"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0 (SP6)"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	vsc1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\Version\ = "1.0"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0 (SP6)"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\VersionIndependentProgID\ = "MSWinsock.Winsock"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\InprocServer32	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{39977C62-C383-463D-AF61-C71220634656}"	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0 (SP6)"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\MiscStatus\1	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx, 1"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\InprocServer32\ThreadingModel = "Apartment"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	vsc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	vsc1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	vsc1.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	969f133d61986ccccfdfc4c6f746b867.exe
1232	969f133d61986ccccfdfc4c6f746b867.exe
2140	969f133d61986ccccfdfc4c6f746b867.exe
2636	vsc1.exe
2868	vsc1.exe
1076	vsc1.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1232	2040	969f133d61986ccccfdfc4c6f746b867.exe	28
PID 2040 wrote to memory of 1232	2040	969f133d61986ccccfdfc4c6f746b867.exe	28
PID 2040 wrote to memory of 1232	2040	969f133d61986ccccfdfc4c6f746b867.exe	28
PID 2040 wrote to memory of 1232	2040	969f133d61986ccccfdfc4c6f746b867.exe	28
PID 2040 wrote to memory of 1232	2040	969f133d61986ccccfdfc4c6f746b867.exe	28
PID 2040 wrote to memory of 1232	2040	969f133d61986ccccfdfc4c6f746b867.exe	28
PID 2040 wrote to memory of 1232	2040	969f133d61986ccccfdfc4c6f746b867.exe	28
PID 2040 wrote to memory of 1232	2040	969f133d61986ccccfdfc4c6f746b867.exe	28
PID 2040 wrote to memory of 1232	2040	969f133d61986ccccfdfc4c6f746b867.exe	28
PID 1232 wrote to memory of 2140	1232	969f133d61986ccccfdfc4c6f746b867.exe	30
PID 1232 wrote to memory of 2140	1232	969f133d61986ccccfdfc4c6f746b867.exe	30
PID 1232 wrote to memory of 2140	1232	969f133d61986ccccfdfc4c6f746b867.exe	30
PID 1232 wrote to memory of 2140	1232	969f133d61986ccccfdfc4c6f746b867.exe	30
PID 1232 wrote to memory of 2140	1232	969f133d61986ccccfdfc4c6f746b867.exe	30
PID 1232 wrote to memory of 2140	1232	969f133d61986ccccfdfc4c6f746b867.exe	30
PID 1232 wrote to memory of 2140	1232	969f133d61986ccccfdfc4c6f746b867.exe	30
PID 1232 wrote to memory of 2140	1232	969f133d61986ccccfdfc4c6f746b867.exe	30
PID 1232 wrote to memory of 2140	1232	969f133d61986ccccfdfc4c6f746b867.exe	30
PID 2140 wrote to memory of 2636	2140	969f133d61986ccccfdfc4c6f746b867.exe	29
PID 2140 wrote to memory of 2636	2140	969f133d61986ccccfdfc4c6f746b867.exe	29
PID 2140 wrote to memory of 2636	2140	969f133d61986ccccfdfc4c6f746b867.exe	29
PID 2140 wrote to memory of 2636	2140	969f133d61986ccccfdfc4c6f746b867.exe	29
PID 2636 wrote to memory of 2868	2636	vsc1.exe	31
PID 2636 wrote to memory of 2868	2636	vsc1.exe	31
PID 2636 wrote to memory of 2868	2636	vsc1.exe	31
PID 2636 wrote to memory of 2868	2636	vsc1.exe	31
PID 2636 wrote to memory of 2868	2636	vsc1.exe	31
PID 2636 wrote to memory of 2868	2636	vsc1.exe	31
PID 2636 wrote to memory of 2868	2636	vsc1.exe	31
PID 2636 wrote to memory of 2868	2636	vsc1.exe	31
PID 2636 wrote to memory of 2868	2636	vsc1.exe	31
PID 2868 wrote to memory of 1076	2868	vsc1.exe	32
PID 2868 wrote to memory of 1076	2868	vsc1.exe	32
PID 2868 wrote to memory of 1076	2868	vsc1.exe	32
PID 2868 wrote to memory of 1076	2868	vsc1.exe	32
PID 2868 wrote to memory of 1076	2868	vsc1.exe	32
PID 2868 wrote to memory of 1076	2868	vsc1.exe	32
PID 2868 wrote to memory of 1076	2868	vsc1.exe	32
PID 2868 wrote to memory of 1076	2868	vsc1.exe	32
PID 2868 wrote to memory of 1076	2868	vsc1.exe	32

C:\Users\Admin\AppData\Local\Temp\969f133d61986ccccfdfc4c6f746b867.exe
"C:\Users\Admin\AppData\Local\Temp\969f133d61986ccccfdfc4c6f746b867.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\969f133d61986ccccfdfc4c6f746b867.exe
  "C:\Users\Admin\AppData\Local\Temp\969f133d61986ccccfdfc4c6f746b867.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Users\Admin\AppData\Local\Temp\969f133d61986ccccfdfc4c6f746b867.exe
    "C:\Users\Admin\AppData\Local\Temp\969f133d61986ccccfdfc4c6f746b867.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2140

C:\Program Files (x86)\vsc1.exe
"C:\Program Files (x86)\vsc1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\vsc1.exe
  "C:\Program Files (x86)\vsc1.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Program Files (x86)\vsc1.exe
    "C:\Program Files (x86)\vsc1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\vsc1.exe

Filesize
500KB

MD5
969f133d61986ccccfdfc4c6f746b867

SHA1
71075f4b24aafd1339627dee3f7531f12fe60938

SHA256
cc756b37d620316333438196441d932dba6748092b17a162eded5ba4bb4689fa

SHA512
8abadbb818d3d6e320f9df3e8b19e0322c30aa8d50701a7b5806f6f731558f43fec7c5c8acb8d59a1d80cdf95a5c5931926bb8df4841889ec2e33815b0d9e3eb

Download Submit
\Windows\SysWOW64\MSWINSCK.ocx

Filesize
124KB

MD5
40fce4be52f6015c23fd96a4b3351357

SHA1
f4a23cee42125f20444a4b005555d631df2aaacf

SHA256
a0bf5f1ed8d34fd0b6cb1432618986f90256ef4f8c86a1460823e6dfa8edd8ca

SHA512
69f7a8c8a5e82a2c975e410d834aa24ed0b1a32f592fb85eac15b8d3c1bee2dc1c1c88c0dbba0435339cde92e437efebf66c7c15dde1153338b4bd3e536fc922

Download Submit
memory/1076-94-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1076-81-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1076-89-0x0000000000400000-0x000000000043B22C-memory.dmp

Filesize
236KB

Download
memory/1232-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1232-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1232-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1232-17-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1232-87-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1232-2-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1232-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1232-4-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2140-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2140-45-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2140-46-0x0000000000400000-0x000000000043B22C-memory.dmp

Filesize
236KB

Download
memory/2140-18-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2140-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2140-28-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2140-30-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2140-24-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2868-77-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2868-88-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads