f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe
Size

1.1MB
MD5

63d443768574105baa3a6f6673746d4a
SHA1

b176c4062f7959b898e2ce0706c42a4218751106
SHA256

f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867
SHA512

542e413ee9eee223bdb49ef115ec4dbe3b98228d59469a94dc0051e09f7e2d47fc06f9ecd83c4889ba7b520494dca76044a0a8da8ef44a6850f9a45578f06354
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QZ:CcaClSFlG4ZM7QzM6

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2644	svchcst.exe

Executes dropped EXE 6 IoCs

pid	Process
2644	svchcst.exe
2408	svchcst.exe
1992	svchcst.exe
2276	svchcst.exe
436	svchcst.exe
1288	svchcst.exe

Loads dropped DLL 9 IoCs

pid	Process
2700	WScript.exe
2700	WScript.exe
2420	WScript.exe
568	WScript.exe
568	WScript.exe
1152	WScript.exe
2928	WScript.exe
1292	WScript.exe
1292	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1612	f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2644	svchcst.exe
2408	svchcst.exe
2408	svchcst.exe
2408	svchcst.exe
2408	svchcst.exe
2408	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1612	f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1612	f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe
1612	f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe
2644	svchcst.exe
2644	svchcst.exe
2408	svchcst.exe
2408	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
2276	svchcst.exe
2276	svchcst.exe
436	svchcst.exe
436	svchcst.exe
1288	svchcst.exe
1288	svchcst.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2700	1612	f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe	28
PID 1612 wrote to memory of 2700	1612	f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe	28
PID 1612 wrote to memory of 2700	1612	f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe	28
PID 1612 wrote to memory of 2700	1612	f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe	28
PID 2700 wrote to memory of 2644	2700	WScript.exe	30
PID 2700 wrote to memory of 2644	2700	WScript.exe	30
PID 2700 wrote to memory of 2644	2700	WScript.exe	30
PID 2700 wrote to memory of 2644	2700	WScript.exe	30
PID 2644 wrote to memory of 2420	2644	svchcst.exe	31
PID 2644 wrote to memory of 2420	2644	svchcst.exe	31
PID 2644 wrote to memory of 2420	2644	svchcst.exe	31
PID 2644 wrote to memory of 2420	2644	svchcst.exe	31
PID 2420 wrote to memory of 2408	2420	WScript.exe	32
PID 2420 wrote to memory of 2408	2420	WScript.exe	32
PID 2420 wrote to memory of 2408	2420	WScript.exe	32
PID 2420 wrote to memory of 2408	2420	WScript.exe	32
PID 2408 wrote to memory of 568	2408	svchcst.exe	33
PID 2408 wrote to memory of 568	2408	svchcst.exe	33
PID 2408 wrote to memory of 568	2408	svchcst.exe	33
PID 2408 wrote to memory of 568	2408	svchcst.exe	33
PID 2408 wrote to memory of 1880	2408	svchcst.exe	34
PID 2408 wrote to memory of 1880	2408	svchcst.exe	34
PID 2408 wrote to memory of 1880	2408	svchcst.exe	34
PID 2408 wrote to memory of 1880	2408	svchcst.exe	34
PID 568 wrote to memory of 1992	568	WScript.exe	35
PID 568 wrote to memory of 1992	568	WScript.exe	35
PID 568 wrote to memory of 1992	568	WScript.exe	35
PID 568 wrote to memory of 1992	568	WScript.exe	35
PID 1992 wrote to memory of 1152	1992	svchcst.exe	36
PID 1992 wrote to memory of 1152	1992	svchcst.exe	36
PID 1992 wrote to memory of 1152	1992	svchcst.exe	36
PID 1992 wrote to memory of 1152	1992	svchcst.exe	36
PID 1152 wrote to memory of 2276	1152	WScript.exe	39
PID 1152 wrote to memory of 2276	1152	WScript.exe	39
PID 1152 wrote to memory of 2276	1152	WScript.exe	39
PID 1152 wrote to memory of 2276	1152	WScript.exe	39
PID 2276 wrote to memory of 2928	2276	svchcst.exe	40
PID 2276 wrote to memory of 2928	2276	svchcst.exe	40
PID 2276 wrote to memory of 2928	2276	svchcst.exe	40
PID 2276 wrote to memory of 2928	2276	svchcst.exe	40
PID 2928 wrote to memory of 436	2928	WScript.exe	41
PID 2928 wrote to memory of 436	2928	WScript.exe	41
PID 2928 wrote to memory of 436	2928	WScript.exe	41
PID 2928 wrote to memory of 436	2928	WScript.exe	41
PID 436 wrote to memory of 1292	436	svchcst.exe	42
PID 436 wrote to memory of 1292	436	svchcst.exe	42
PID 436 wrote to memory of 1292	436	svchcst.exe	42
PID 436 wrote to memory of 1292	436	svchcst.exe	42
PID 1292 wrote to memory of 1288	1292	WScript.exe	43
PID 1292 wrote to memory of 1288	1292	WScript.exe	43
PID 1292 wrote to memory of 1288	1292	WScript.exe	43
PID 1292 wrote to memory of 1288	1292	WScript.exe	43

C:\Users\Admin\AppData\Local\Temp\f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe
"C:\Users\Admin\AppData\Local\Temp\f11acc2eb117f15deedd95375a16db4e21fd8c1de745e5ce889b8a67ddcf1867.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        10⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        12⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        11⤵
        
        PID:1892
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        
        PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

Filesize
92B

MD5
67b9b3e2ded7086f393ebbc36c5e7bca

SHA1
e6299d0450b9a92a18cc23b5704a2b475652c790

SHA256
44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d

SHA512
826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
a28791ebea83786bb5889ef857a9e493

SHA1
0c7cc3d05c844d5edd4535fbd48d2c73b2764630

SHA256
ad8607d9518b14cf6e9f567194700afa64c424bbe7da5b1819babbc7678a98bf

SHA512
d357643579f32de1c3f28b9d717d4d82a91d2ae25014a2ab52c0b6340ea577c31386cfa7901694f47889e5966ab11ff6888ae19a8602f812d2484827295d12ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
73dd42e0ba8cff47f0542d7d8aa40f90

SHA1
ffbb1b56415be5abcf4613aed3136768f2edbc38

SHA256
c73b4e554a4ae515ae3aa320a19d752e3d848d00ed0cd8f084081ed530b8fc3d

SHA512
efd0075f9e70dd557271bdbcd782a083ae2cde8cd5674bf7f8cf63064847951adfcbaa9c9cff91c57d19c7308d0b7bf4754bfbe8fce6ec0e41d920bde7f5a67e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
66dec81d7f7dc4e36f9d8151fe38056a

SHA1
fc169994b2239eb407778d28d35025f7c9a1658e

SHA256
a09a3c722b494400011829c5645415020d39c8e6ec90f466fc3109a1ba49db2a

SHA512
3e8af1d301ba9228d5afcfaa1e1d3e6f931c5f0ba5e19c74f73b88ddf7c4baa7b24f13533679096f6c94871985de9e47d0f91362ec2ee9132b1e1b772d56fbcc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
2551ae733b39ac9061a9d5ebd2f29d98

SHA1
08247d27dd5bf959db0b29d3e5b0551dc47c9d02

SHA256
c69ee4a632cc1c351d5fa930d42546923a4125e7d9cbccb2ad9f9e3318be2b77

SHA512
a1c669cb87194c2b496a7131f7f2920b6c31156f88d6c1140e79f3b83fbca3785cd57fea2d47cb951ed576e69a1240e81746a5bc5444e65fd05fa5234125731c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
9e8dca236ce949019c46b94428612ac9

SHA1
0917050afcbb7b94fce6fbb9827fb57de7432b0b

SHA256
bd9f06dbb8f2165c3b75da289ad7983f0c57328d236b2c68a2b5798188874fb3

SHA512
23ce9deba9286cbb24c1725503542b63d7e44ea7ada302e5aba6595f84398e2162008d7431f842cccfb2b8fae126216d85c566931d5fcc8c8c5625e2c05f44d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
a7ec6999c674024b9fd5da3a32aae637

SHA1
501cbc9a3d6a5520ba5764d4ae5785ccc774c6a7

SHA256
150da7ec472fc37590865701f3a80ea6578927a6b3170689712caa2970935b95

SHA512
9f7f6859cd0da1ca4285db13b0d9f29c56f9802f2c980be1dd3de86c1f2ed307331c21a59c368f26be50cde94607629bc854565bb5c1e5585c066880098dd866

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
1.1MB

MD5
1296c63f0f467112a3ce642fb36d9464

SHA1
3f8574a2603efb1ae953b1f8e183eb0f2038155a

SHA256
602defd21c02a0d0a75c1f38202cb951f5fc32b19c267f404a0ca89d95dc3c9c

SHA512
34356c86afbcebdeec6536839c98202135dcd11d4110927a1cb9bf6cd9c3fc15bedcee409606ab5bc3b1f25b9f65ba809d06b5f2e687e28a45ef1db5e390fff3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
1.1MB

MD5
2273e92a362b4fb8cafa5e3ee41b4990

SHA1
2350195f2834face4a65cca273170e9a41ab174b

SHA256
aa6b46a8a98431fa42edba4c5c03c58629ca188dba894ff3cf1fff6c8bf4c5f1

SHA512
928e35541dbcd01a93efefc87d4df8882a06b191c7f16ec838e8a779adb2c022b6e86cd1f72f8a2b2d95bf657b45db3120130aeef62763534b1a1976f12c3d87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
1.1MB

MD5
068aa174094a98ac6a347324cb3c5a75

SHA1
ce0fe82881c38e3accafb0b585dfb6a6ce4d7a96

SHA256
1a828d952fda2f8b311ea124fa45d20a50e1a5c79bbabc530741503754dbf651

SHA512
b85748c62c94ef8c1ff253e5ee908a618a86dc155a31fa4c060a1b099056efcf7be7f5b4d4935c9459a930076bd8cde173682d3ab0d6970e8b7006f586abd82a

Download Submit
memory/1612-8-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download