Analysis
- max time kernel
29s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe
- Size 1.1MB
- Sample240613-c398gs1fpc
- SHA256 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130
- MD5 f1ec3e7dfcd12fdbb3dd50ef485de5ba
- SHA1 955a6b008b35df47067c4111174b62c7980f04b6
- SHA512 024fcf10ef896fcc4b78e11dc8a5f262f8fea7717a8af6fdbcfe7d9d6d43680fefd6bac8ec296a4cc2f515e5dfd055890416b012ce1dd15542d9a5bdc436bac3
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qa:CcaClSFlG4ZM7QzM5
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation svchcst.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe - Deletes itself 1 IoCs
pid Process 4136 svchcst.exe - Executes dropped EXE 7 IoCs
pid Process 412 svchcst.exe 4136 svchcst.exe 3384 svchcst.exe 232 svchcst.exe 948 svchcst.exe 4560 svchcst.exe 2400 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe 4136 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 4136 svchcst.exe 4136 svchcst.exe 412 svchcst.exe 412 svchcst.exe 3384 svchcst.exe 3384 svchcst.exe 232 svchcst.exe 232 svchcst.exe 948 svchcst.exe 948 svchcst.exe 4560 svchcst.exe 4560 svchcst.exe 2400 svchcst.exe 2400 svchcst.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4400 wrote to memory of 1696 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 99 PID 4400 wrote to memory of 1696 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 99 PID 4400 wrote to memory of 1696 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 99 PID 4400 wrote to memory of 4536 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 95 PID 4400 wrote to memory of 4536 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 95 PID 4400 wrote to memory of 4536 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 95 PID 4400 wrote to memory of 4268 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 96 PID 4400 wrote to memory of 4268 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 96 PID 4400 wrote to memory of 4268 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 96 PID 4400 wrote to memory of 3500 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 101 PID 4400 wrote to memory of 3500 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 101 PID 4400 wrote to memory of 3500 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 101 PID 4400 wrote to memory of 3992 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 98 PID 4400 wrote to memory of 3992 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 98 PID 4400 wrote to memory of 3992 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 98 PID 4400 wrote to memory of 1596 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 102 PID 4400 wrote to memory of 1596 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 102 PID 4400 wrote to memory of 1596 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 102 PID 4400 wrote to memory of 812 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 92 PID 4400 wrote to memory of 812 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 92 PID 4400 wrote to memory of 812 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 92 PID 4400 wrote to memory of 2224 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 93 PID 4400 wrote to memory of 2224 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 93 PID 4400 wrote to memory of 2224 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 93 PID 4400 wrote to memory of 5088 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 94 PID 4400 wrote to memory of 5088 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 94 PID 4400 wrote to memory of 5088 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 94 PID 4400 wrote to memory of 4860 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 97 PID 4400 wrote to memory of 4860 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 97 PID 4400 wrote to memory of 4860 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 97 PID 4400 wrote to memory of 1536 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 100 PID 4400 wrote to memory of 1536 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 100 PID 4400 wrote to memory of 1536 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 100 PID 4400 wrote to memory of 2572 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 91 PID 4400 wrote to memory of 2572 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 91 PID 4400 wrote to memory of 2572 4400 00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe 91 PID 2224 wrote to memory of 412 2224 WScript.exe 104 PID 2224 wrote to memory of 412 2224 WScript.exe 104 PID 2224 wrote to memory of 412 2224 WScript.exe 104 PID 3500 wrote to memory of 4136 3500 WScript.exe 105 PID 3500 wrote to memory of 4136 3500 WScript.exe 105 PID 3500 wrote to memory of 4136 3500 WScript.exe 105 PID 3992 wrote to memory of 3384 3992 WScript.exe 106 PID 3992 wrote to memory of 3384 3992 WScript.exe 106 PID 3992 wrote to memory of 3384 3992 WScript.exe 106 PID 4536 wrote to memory of 232 4536 WScript.exe 107 PID 4536 wrote to memory of 232 4536 WScript.exe 107 PID 4536 wrote to memory of 232 4536 WScript.exe 107 PID 1596 wrote to memory of 948 1596 WScript.exe 108 PID 1596 wrote to memory of 948 1596 WScript.exe 108 PID 1596 wrote to memory of 948 1596 WScript.exe 108 PID 1536 wrote to memory of 4560 1536 WScript.exe 109 PID 1536 wrote to memory of 4560 1536 WScript.exe 109 PID 1536 wrote to memory of 4560 1536 WScript.exe 109 PID 4560 wrote to memory of 2156 4560 svchcst.exe 110 PID 4560 wrote to memory of 2156 4560 svchcst.exe 110 PID 4560 wrote to memory of 2156 4560 svchcst.exe 110 PID 3500 wrote to memory of 2400 3500 WScript.exe 114 PID 3500 wrote to memory of 2400 3500 WScript.exe 114 PID 3500 wrote to memory of 2400 3500 WScript.exe 114 PID 2400 wrote to memory of 1292 2400 svchcst.exe 115 PID 2400 wrote to memory of 1292 2400 svchcst.exe 115 PID 2400 wrote to memory of 1292 2400 svchcst.exe 115 PID 2400 wrote to memory of 3664 2400 svchcst.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe"C:\Users\Admin\AppData\Local\Temp\00df63cde3d583295d1f7efa25f886991e49a81bc5a3d66552606053d693d130.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵PID:2572
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵PID:812
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:412
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
PID:5088
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:232
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
PID:4268
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
PID:4860
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3384
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
PID:1696
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵PID:2156
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4136
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵PID:1292
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵PID:1600
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵PID:3664
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵PID:4436
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵PID:4464
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:948
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:1652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 4a4c85c789ae8c308a6aed52c6a023255c2ceb308899ffbe18b0af71fd9bf518
- MD5 6e63f92b93f014f70554b628d93035fb
- SHA1 9fe3bc1a744c02a53f82df8376c0fe920a80f4e0
- SHA512 3f10537b19f9db1112058bedb94c8898073efb9c1ccbd027e9416db87bec434d41f73b161d1edb0afc127511d0844762603eb5bfbb2f80b461f9c71b2a42f249
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 76a6ce5f2e579dc37db23bb0e1ef5ebdd8b02e6b22b6f8da1a17964db237a8a0
- MD5 aac0fba8016aa15609aa7abb5db077ae
- SHA1 f8afa6ff11a91f46eb961727ec6a5fad360fa1c9
- SHA512 26a4910f08563b7c4b1e1abba82fefdefcb43b7d1149d5e6c7dda36db4aa142c4b74bc64263f23a5177804e2191696795e0de5d5368ea6903b398415d435962e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 bd9f06dbb8f2165c3b75da289ad7983f0c57328d236b2c68a2b5798188874fb3
- MD5 9e8dca236ce949019c46b94428612ac9
- SHA1 0917050afcbb7b94fce6fbb9827fb57de7432b0b
- SHA512 23ce9deba9286cbb24c1725503542b63d7e44ea7ada302e5aba6595f84398e2162008d7431f842cccfb2b8fae126216d85c566931d5fcc8c8c5625e2c05f44d6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 2b0a8d4d660fb0a0c6a5af5a283f4eb772ccec7b3e5335699f9395ca73eb2676
- MD5 45e74428d59dc44c009b624b80c3deb7
- SHA1 42451af2f8b3fce6c4b6bd1cbc8cc0ae917f0bd3
- SHA512 78ead052f89f33955df38c6b65f277711a516ae355925703517b622ec7ebe32ebada15a3182e0408e67c489669de9a1e9ae35adfb850b7ac87fcee80ade09349
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qr:CcaClSFlG4ZM7QzMM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 343a2d718d34074fd8222a3da9bd939f23280a8ee31866b7c60546e44a786fda
- MD5 f4b685cf59c853f3a89c397e257ff524
- SHA1 03f83ac0a78efe8439e165a95208f0a51d4e52aa
- SHA512 b20135c7b9a78a9d11401806e857c35a7351810333fe13caa9c20e9dcd70e04992862b849a97d55cc181125d3922031a5da9efd47880542358788ba98b289e33
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qr:CcaClSFlG4ZM7QzM8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.1MB
- SHA256 10465b1107316075a2da6e2b59149c15cca67be78218403dbdd05136b5e45870
- MD5 3fd45373fa96b6347d7d394e618b0888
- SHA1 70e7a759628e866c5072c78cfc0a971a50b7389b
- SHA512 681bd82771001b9dfca49556fdf0da02c7caded93d38aa0e6cf2214544667e393f8d77ab736af6adc936095cfc6526f543fc76d3add122c85e5cfb4ee7c1accc
- SSDEEP 24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qw:CcaClSFlG4ZM7QzM3
- MD5 SHA1 SHA512 SSDEEP