8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe
Size 1.1MB
Sample240612-htq15stdmc
SHA256 8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66
MD5 ade0075afdb019691a208ce370469d53
SHA1 deb3cb64258bc272a04a220dacf5c7d06a4eb300
SHA512 cf3446b9100759ae4b5f6435eaf79c9e124960125ea3a086e3173407bb09e03f00bd46942a27d501e88616763a10127cccd159ed6e9c3074dc163356f73e1aad
SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qi:CcaClSFlG4ZM7QzMx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1992	svchcst.exe

Executes dropped EXE 23 IoCs

pid	Process
1992	svchcst.exe
344	svchcst.exe
1520	svchcst.exe
1284	svchcst.exe
540	svchcst.exe
2960	svchcst.exe
884	svchcst.exe
2224	svchcst.exe
2812	svchcst.exe
3020	svchcst.exe
2820	svchcst.exe
2448	svchcst.exe
780	svchcst.exe
1644	svchcst.exe
560	svchcst.exe
1476	svchcst.exe
2988	svchcst.exe
2788	svchcst.exe
2640	svchcst.exe
1108	svchcst.exe
2816	svchcst.exe
1036	svchcst.exe
540	svchcst.exe

Loads dropped DLL 42 IoCs

pid	Process
2360	WScript.exe
2360	WScript.exe
2412	WScript.exe
2412	WScript.exe
1612	WScript.exe
1612	WScript.exe
2836	WScript.exe
2836	WScript.exe
1252	WScript.exe
1252	WScript.exe
560	WScript.exe
1300	WScript.exe
1300	WScript.exe
1300	WScript.exe
1796	WScript.exe
1796	WScript.exe
2516	WScript.exe
2516	WScript.exe
888	WScript.exe
1360	WScript.exe
1360	WScript.exe
1360	WScript.exe
2076	WScript.exe
2076	WScript.exe
1812	WScript.exe
1812	WScript.exe
3004	WScript.exe
3004	WScript.exe
3004	WScript.exe
3004	WScript.exe
1608	WScript.exe
1608	WScript.exe
2528	WScript.exe
2528	WScript.exe
1688	WScript.exe
1688	WScript.exe
1624	WScript.exe
1624	WScript.exe
2832	WScript.exe
2832	WScript.exe
580	WScript.exe
580	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2040	8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
1992	svchcst.exe
344	svchcst.exe
344	svchcst.exe
344	svchcst.exe
344	svchcst.exe
344	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2040	8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe

Suspicious use of SetWindowsHookEx 48 IoCs

pid	Process
2040	8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe
2040	8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe
1992	svchcst.exe
1992	svchcst.exe
344	svchcst.exe
344	svchcst.exe
1520	svchcst.exe
1520	svchcst.exe
1284	svchcst.exe
1284	svchcst.exe
540	svchcst.exe
540	svchcst.exe
2960	svchcst.exe
2960	svchcst.exe
884	svchcst.exe
884	svchcst.exe
2224	svchcst.exe
2224	svchcst.exe
2812	svchcst.exe
2812	svchcst.exe
3020	svchcst.exe
3020	svchcst.exe
2820	svchcst.exe
2820	svchcst.exe
2448	svchcst.exe
2448	svchcst.exe
780	svchcst.exe
780	svchcst.exe
1644	svchcst.exe
1644	svchcst.exe
560	svchcst.exe
560	svchcst.exe
1476	svchcst.exe
1476	svchcst.exe
2988	svchcst.exe
2988	svchcst.exe
2788	svchcst.exe
2788	svchcst.exe
2640	svchcst.exe
2640	svchcst.exe
1108	svchcst.exe
1108	svchcst.exe
2816	svchcst.exe
2816	svchcst.exe
1036	svchcst.exe
1036	svchcst.exe
540	svchcst.exe
540	svchcst.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2360	2040	8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe	28
PID 2040 wrote to memory of 2360	2040	8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe	28
PID 2040 wrote to memory of 2360	2040	8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe	28
PID 2040 wrote to memory of 2360	2040	8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe	28
PID 2360 wrote to memory of 1992	2360	WScript.exe	30
PID 2360 wrote to memory of 1992	2360	WScript.exe	30
PID 2360 wrote to memory of 1992	2360	WScript.exe	30
PID 2360 wrote to memory of 1992	2360	WScript.exe	30
PID 1992 wrote to memory of 2412	1992	svchcst.exe	31
PID 1992 wrote to memory of 2412	1992	svchcst.exe	31
PID 1992 wrote to memory of 2412	1992	svchcst.exe	31
PID 1992 wrote to memory of 2412	1992	svchcst.exe	31
PID 2412 wrote to memory of 344	2412	WScript.exe	32
PID 2412 wrote to memory of 344	2412	WScript.exe	32
PID 2412 wrote to memory of 344	2412	WScript.exe	32
PID 2412 wrote to memory of 344	2412	WScript.exe	32
PID 344 wrote to memory of 1612	344	svchcst.exe	33
PID 344 wrote to memory of 1612	344	svchcst.exe	33
PID 344 wrote to memory of 1612	344	svchcst.exe	33
PID 344 wrote to memory of 1612	344	svchcst.exe	33
PID 1612 wrote to memory of 1520	1612	WScript.exe	34
PID 1612 wrote to memory of 1520	1612	WScript.exe	34
PID 1612 wrote to memory of 1520	1612	WScript.exe	34
PID 1612 wrote to memory of 1520	1612	WScript.exe	34
PID 1520 wrote to memory of 2836	1520	svchcst.exe	35
PID 1520 wrote to memory of 2836	1520	svchcst.exe	35
PID 1520 wrote to memory of 2836	1520	svchcst.exe	35
PID 1520 wrote to memory of 2836	1520	svchcst.exe	35
PID 2836 wrote to memory of 1284	2836	WScript.exe	36
PID 2836 wrote to memory of 1284	2836	WScript.exe	36
PID 2836 wrote to memory of 1284	2836	WScript.exe	36
PID 2836 wrote to memory of 1284	2836	WScript.exe	36
PID 1284 wrote to memory of 1252	1284	svchcst.exe	37
PID 1284 wrote to memory of 1252	1284	svchcst.exe	37
PID 1284 wrote to memory of 1252	1284	svchcst.exe	37
PID 1284 wrote to memory of 1252	1284	svchcst.exe	37
PID 1252 wrote to memory of 540	1252	WScript.exe	38
PID 1252 wrote to memory of 540	1252	WScript.exe	38
PID 1252 wrote to memory of 540	1252	WScript.exe	38
PID 1252 wrote to memory of 540	1252	WScript.exe	38
PID 540 wrote to memory of 560	540	svchcst.exe	39
PID 540 wrote to memory of 560	540	svchcst.exe	39
PID 540 wrote to memory of 560	540	svchcst.exe	39
PID 540 wrote to memory of 560	540	svchcst.exe	39
PID 560 wrote to memory of 2960	560	WScript.exe	40
PID 560 wrote to memory of 2960	560	WScript.exe	40
PID 560 wrote to memory of 2960	560	WScript.exe	40
PID 560 wrote to memory of 2960	560	WScript.exe	40
PID 2960 wrote to memory of 1300	2960	svchcst.exe	41
PID 2960 wrote to memory of 1300	2960	svchcst.exe	41
PID 2960 wrote to memory of 1300	2960	svchcst.exe	41
PID 2960 wrote to memory of 1300	2960	svchcst.exe	41
PID 1300 wrote to memory of 884	1300	WScript.exe	42
PID 1300 wrote to memory of 884	1300	WScript.exe	42
PID 1300 wrote to memory of 884	1300	WScript.exe	42
PID 1300 wrote to memory of 884	1300	WScript.exe	42
PID 884 wrote to memory of 3052	884	svchcst.exe	43
PID 884 wrote to memory of 3052	884	svchcst.exe	43
PID 884 wrote to memory of 3052	884	svchcst.exe	43
PID 884 wrote to memory of 3052	884	svchcst.exe	43
PID 1300 wrote to memory of 2224	1300	WScript.exe	46
PID 1300 wrote to memory of 2224	1300	WScript.exe	46
PID 1300 wrote to memory of 2224	1300	WScript.exe	46
PID 1300 wrote to memory of 2224	1300	WScript.exe	46

C:\Users\Admin\AppData\Local\Temp\8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe
"C:\Users\Admin\AppData\Local\Temp\8b810203555e70aa85c681e25b8c0e34317f70a616a78414a5361c4b6ab74e66.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:344
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        10⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        12⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        14⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:884
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        16⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        16⤵
        Loads dropped DLL
        
        PID:1796
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        18⤵
        Loads dropped DLL
        
        PID:2516
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        20⤵
        Loads dropped DLL
        
        PID:888
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        22⤵
        Loads dropped DLL
        
        PID:1360
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        24⤵
        Loads dropped DLL
        
        PID:2076
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        26⤵
        Loads dropped DLL
        
        PID:1812
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:560
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        28⤵
        Loads dropped DLL
        
        PID:3004
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        30⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        30⤵
        Loads dropped DLL
        
        PID:1608
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        32⤵
        Loads dropped DLL
        
        PID:2528
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        34⤵
        Loads dropped DLL
        
        PID:1688
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        36⤵
        Loads dropped DLL
        
        PID:1624
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        38⤵
        Loads dropped DLL
        
        PID:2832
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        40⤵
        Loads dropped DLL
        
        PID:580
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        42⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:780
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        24⤵
        
        PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 a96ad3511edfa4d9f9533a533a7bb6e0453acd6359249763c69fa6a3ddd9862b
MD5 44f2dc96c884388043c0abf5792ceed9
SHA1 0e8332227b64dfd0636d5e17818fea8b67840038
SHA512 3e1d7c0455e6be9d46f73eeb3216945e900577c869fd836e44acf42f9cef70b11018aa7117fa642acf551d23c82a3f1f3507e4a25a940b3d484e677290c8fc08
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 9eca0120263ab4947d38369d9a4986744e61189382c1d313eb464ad449ea2651
MD5 f02b234115a56496bcd6642d1de04e5d
SHA1 d383b9d3c82fe145f25a9a6e7e4333151fd4ecc6
SHA512 c446eccd822729a81d49321c88ecc0fba4e4f7b6f6277d2660c7f3a18a67614915ae24a96353bf93b039eb441f0c260c1961a1363f16524dbeaf2554626c1b4e
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 854aeaf6ba44537fc01088f8c336552a1aab4c6df84938d241c8616b6f0802e4
MD5 5c256ba320c7487a2c3cdb62bea97bb5
SHA1 2a28e5d7bd4483a40fb6035f1ec6fcf1d66cb2fc
SHA512 bb55f293471dda9b074664d4cf2dad094f8f0c2479c1fd754dd85199d1d1b1012cfa3b050711ac0b59368d6bf1756cfcadcaff1e47d4f103a093a0b77782fdc0
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 1a6710caaf3886be368f3205ee8c9905e10f8ed754d80598c80f1455a700d846
MD5 b42266100fb9f5e0b7be593aac3c37cf
SHA1 7cd55f31fd2871d09de73a6f62e3a7e1a53327b2
SHA512 d3e5a4f7395d6196403e60214239043b2da6e546cbe080f74c3a680a6f4a7fe1374988df0a1aa84dbc0e41199efd8fb11050d1d1295f3b45811935d740a5108b
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 83a3606b4d4b48761b768ff2bd5668a599025f46b5d31b73bd0b014f6f95e225
MD5 e94e88174ec781f873054a1341dde3c1
SHA1 1bfcc1fd57262661e3e17db7f582004d481e95d9
SHA512 10dd4c89ea250920267a33317f693093471b805e33f18b38ffd7e3b9fb12624047f6bca7c82b0a2c83a3d6cead4d289f3da723b249a7ab6a9c40b339977fe7f6
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 2e455d4d9ba6db3056e273b33c3cc67d60d76c4a750b98b2d4d0e2bcc6aa57b1
MD5 93bffb400f506fbd69421b6075802c65
SHA1 b9d8c4ea6a8fd739f6cf167e1f58412525f15784
SHA512 e00a5d4ad19c488dc18e50150fcd50505133666e333f12f9e0cb3a894162951e4195886798de3531561ff99b4a3fbca6fb351f1ff0bcd0e1ac20cd685962ec23
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 7acb095ca5298eb1d1e2ba7f02c1b876d7d28684762a9d180ae2ed8c9e68beb2
MD5 aa6578debd9e5045ad239d59ebeb6d15
SHA1 2a25e6293914cd6ada6649f34506c8bcf35494aa
SHA512 150796c7aad73d1732103e41bd01d3c181b4a0afd37b673d184d5c6c643622704e7692b668e231a319549c2bb378f4d83c7ede82caf81dd15c934b81936e22b2
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 099ad392a60ee09509cf2982deb126acb373115124e33c1c9d18931fa32af630
MD5 bd0cc8385e2c94da465451e7bd8d4303
SHA1 6866d3d8d4bc37bbd976b44b74d4cef9b018da66
SHA512 5212403107457416b6b8e3c033c9521f744845edbf0c9bba5c962bea5946c2a24e1081cf472e907b3e16fb593b98c119802e3162e5260b30574f2c086af3d6b2
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 da674cdbd4dd762cc32ce0bd2ec36929a626e0e87f7ab7a4a1b1e1ce0123d999
MD5 41bdc303960afcda8ebae4f3e29f0b52
SHA1 4cbf649fb04c836614138308a06ecd48dcb2882d
SHA512 800b5b01cc41e7633f203579e7f6ec0a9f6408f7af79dcfa74596be9264dbb8baade6b1439dedb5194496aa27b8b0e2680ce65ad91032138ea0ac2c8a0872cf1
MD5 SHA1 SHA512

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 0d0dc93c29db4ac7f581f3b952f0f578a9c343334b287cbb4a16ed95a00a6d9a
MD5 b66cb84f3a34fa6591b4068ba7c44768
SHA1 6b6bfaf1322c8bb2753d1c4a58f7928ddd2996fa
SHA512 d6d30d6a82b99e655c07db3a3057204c6e53d01f4162f61e43834c695b67fe9439bde5bcb6b1ee6376292ce29615def98abd828a2a07018f90e44742fda55c8b
SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Ql:CcaClSFlG4ZM7QzM+
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 fe83c96f20a6e772320f75fd5f5697b6f0f0d01b15fd78dac76a61caf723380b
MD5 4f389317be06073beeaaa57e132d6c47
SHA1 6613db1e40eec17b1f42ed414d3977c91c12c5b7
SHA512 fe88c38495e6f0d55febd3607188b591d5e40f187e04624ad67f6949630c19ec81309277d31ef99ca797886f13bcf0bde64a100c51f6a9872a796a9df9eaba44
SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qt:CcaClSFlG4ZM7QzMm
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 ca0dc060203c6b943b821521aecec4accd491bd4900d64508113d68568851401
MD5 5c85cc4a3c64e6b3e38c5e02eb3b0c58
SHA1 448fdb75abf32ce9314717ba9c8bc96150b4e888
SHA512 48cbd33a730eb5bf84e82329e87fa2d6e8b45940b8fbec5b34474f2b5ec87641bc5391bfd32a808fb4f8db46cb6b49ef0b55772a1b7702b44df33c89880feb12
SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QQ:CcaClSFlG4ZM7QzM3
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 84b6daaa8e908b8a66e757f8bb4d47b9f5cd944918ec439d98a835d4107254ff
MD5 9528aa9c4b79904d54a3da2f90cecc9b
SHA1 e9de77a99c5758a6d0a67ddf0ac2993e3d5add80
SHA512 503aee038890640622ce5afe9e32de51c53978f5cb9ed763dce6bed89242c9df3d17f724c7cfb9b284ffdf2e638be40fc28688c7ec51fb930f30fe394f1885e0
SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qe:CcaClSFlG4ZM7QzM1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 df623de42eb4a029407879969aed7c570b96591893f9b97e00e27bdef4f9e67b
MD5 8f41c96a4cf50949484fcd1ab0331d94
SHA1 0f45aaeff93d4840806f461e13679d15083bdce5
SHA512 38942ae29ef3952faa6f7cdb744e0130ed6e789b27d65a668894f82d565a2c795c7833b5abf5ecbb51e05ca8842fc808d4a219c6a2f8e52033e428dc4a66c408
SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QV:CcaClSFlG4ZM7QzMu
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 3987299e855768ad59501a3685d13c7b3387bee59b961338ab970420822a3a26
MD5 6ef562333167937c420af123fb3d90b9
SHA1 290f136eacd52ebca58fb4105e9bd08945516430
SHA512 bf21221e5e9e1c5b40d99f9949b3e2263eaa14237dee5a7d4147654e74cb4618a927d807a9e6b6cb1baced880336f5a1d50ceebe5391dd42cc3a0d4ede13eb5e
SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qe:CcaClSFlG4ZM7QzMV
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 7a658eec89af775afaf1c84288b9e98ea4d9f1ceeceaa442fe144dcf1e674860
MD5 a33c6e86e862b38382525bad55222f29
SHA1 77496b9391a78d7c232b8f1b1dae35b89b6f729d
SHA512 fe997a0adade5a10bc9488101cc7f17694c7db73372a6a5edab46954cb0c5f8aa866a4254b47359aeb291fae51d5916d0f94e87dd61cebf015ae4b50e53af11c
SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QI:CcaClSFlG4ZM7QzMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 8db8fb104aab1634bd55e8fe904cb76b429414423f66a794a47f7cf7699682b3
MD5 32d52329b654b1d7adb9852afb1a2da9
SHA1 9f03e3e438e5452f4ecceedc0d6cb05905c43663
SHA512 ab4c150e9d5bdc823065752879526360a147359c168e01dbd2e2003079c185d8ef1ebf0659f89ba05ffc59c0b6dd5b6c7c371ccb95959ac62d044c5b628833a6
SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QA:CcaClSFlG4ZM7QzMX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2040-8-0x0000000000400000-0x0000000000551000-memory.dmp

Download