405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe
Size 1.1MB
Sample240613-eac4dstamh
SHA256 405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048
MD5 eea2c4b02e0386c3f9f6ee472558b629
SHA1 8b57073c6111211b6928a476559ef026441f8fdb
SHA512 bf110b71b67ebc2bb6afc56c7dee58b082f45c43d08093ff80ae131e6e4da2fff8b5dbd1c5b7498b8e29cb6df6cdb5892b2d02f18863e92041fed4ecb0254bd6
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QP:acallSllG4ZM7QzMI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3068	svchcst.exe

Executes dropped EXE 23 IoCs

pid	Process
3068	svchcst.exe
2972	svchcst.exe
1048	svchcst.exe
2716	svchcst.exe
604	svchcst.exe
1792	svchcst.exe
1804	svchcst.exe
3064	svchcst.exe
2532	svchcst.exe
1944	svchcst.exe
1028	svchcst.exe
688	svchcst.exe
788	svchcst.exe
1336	svchcst.exe
2152	svchcst.exe
1640	svchcst.exe
2580	svchcst.exe
1576	svchcst.exe
1944	svchcst.exe
1740	svchcst.exe
1876	svchcst.exe
668	svchcst.exe
2444	svchcst.exe

Loads dropped DLL 40 IoCs

pid	Process
2268	WScript.exe
2268	WScript.exe
2680	WScript.exe
2712	WScript.exe
2504	WScript.exe
2056	WScript.exe
2056	WScript.exe
1036	WScript.exe
1036	WScript.exe
1624	WScript.exe
1624	WScript.exe
3028	WScript.exe
2804	WScript.exe
2984	WScript.exe
2984	WScript.exe
2984	WScript.exe
2984	WScript.exe
820	WScript.exe
960	WScript.exe
960	WScript.exe
960	WScript.exe
960	WScript.exe
1792	WScript.exe
1792	WScript.exe
1536	WScript.exe
1536	WScript.exe
2932	WScript.exe
2932	WScript.exe
2888	WScript.exe
2888	WScript.exe
2088	WScript.exe
2088	WScript.exe
856	WScript.exe
856	WScript.exe
1844	WScript.exe
1844	WScript.exe
1304	WScript.exe
1304	WScript.exe
1756	WScript.exe
1756	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2128	405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe
2128	405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
3068	svchcst.exe
2972	svchcst.exe
2972	svchcst.exe
2972	svchcst.exe
2972	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2128	405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe

Suspicious use of SetWindowsHookEx 48 IoCs

pid	Process
2128	405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe
2128	405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe
3068	svchcst.exe
3068	svchcst.exe
2972	svchcst.exe
2972	svchcst.exe
1048	svchcst.exe
1048	svchcst.exe
2716	svchcst.exe
2716	svchcst.exe
604	svchcst.exe
604	svchcst.exe
1792	svchcst.exe
1792	svchcst.exe
1804	svchcst.exe
1804	svchcst.exe
3064	svchcst.exe
3064	svchcst.exe
2532	svchcst.exe
2532	svchcst.exe
1944	svchcst.exe
1944	svchcst.exe
1028	svchcst.exe
1028	svchcst.exe
688	svchcst.exe
688	svchcst.exe
788	svchcst.exe
788	svchcst.exe
1336	svchcst.exe
1336	svchcst.exe
2152	svchcst.exe
2152	svchcst.exe
1640	svchcst.exe
1640	svchcst.exe
2580	svchcst.exe
2580	svchcst.exe
1576	svchcst.exe
1576	svchcst.exe
1944	svchcst.exe
1944	svchcst.exe
1740	svchcst.exe
1740	svchcst.exe
1876	svchcst.exe
1876	svchcst.exe
668	svchcst.exe
668	svchcst.exe
2444	svchcst.exe
2444	svchcst.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2268	2128	405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe	28
PID 2128 wrote to memory of 2268	2128	405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe	28
PID 2128 wrote to memory of 2268	2128	405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe	28
PID 2128 wrote to memory of 2268	2128	405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe	28
PID 2268 wrote to memory of 3068	2268	WScript.exe	30
PID 2268 wrote to memory of 3068	2268	WScript.exe	30
PID 2268 wrote to memory of 3068	2268	WScript.exe	30
PID 2268 wrote to memory of 3068	2268	WScript.exe	30
PID 3068 wrote to memory of 2680	3068	svchcst.exe	31
PID 3068 wrote to memory of 2680	3068	svchcst.exe	31
PID 3068 wrote to memory of 2680	3068	svchcst.exe	31
PID 3068 wrote to memory of 2680	3068	svchcst.exe	31
PID 2680 wrote to memory of 2972	2680	WScript.exe	32
PID 2680 wrote to memory of 2972	2680	WScript.exe	32
PID 2680 wrote to memory of 2972	2680	WScript.exe	32
PID 2680 wrote to memory of 2972	2680	WScript.exe	32
PID 2972 wrote to memory of 2712	2972	svchcst.exe	33
PID 2972 wrote to memory of 2712	2972	svchcst.exe	33
PID 2972 wrote to memory of 2712	2972	svchcst.exe	33
PID 2972 wrote to memory of 2712	2972	svchcst.exe	33
PID 2712 wrote to memory of 1048	2712	WScript.exe	34
PID 2712 wrote to memory of 1048	2712	WScript.exe	34
PID 2712 wrote to memory of 1048	2712	WScript.exe	34
PID 2712 wrote to memory of 1048	2712	WScript.exe	34
PID 1048 wrote to memory of 2504	1048	svchcst.exe	35
PID 1048 wrote to memory of 2504	1048	svchcst.exe	35
PID 1048 wrote to memory of 2504	1048	svchcst.exe	35
PID 1048 wrote to memory of 2504	1048	svchcst.exe	35
PID 2504 wrote to memory of 2716	2504	WScript.exe	36
PID 2504 wrote to memory of 2716	2504	WScript.exe	36
PID 2504 wrote to memory of 2716	2504	WScript.exe	36
PID 2504 wrote to memory of 2716	2504	WScript.exe	36
PID 2716 wrote to memory of 2056	2716	svchcst.exe	37
PID 2716 wrote to memory of 2056	2716	svchcst.exe	37
PID 2716 wrote to memory of 2056	2716	svchcst.exe	37
PID 2716 wrote to memory of 2056	2716	svchcst.exe	37
PID 2056 wrote to memory of 604	2056	WScript.exe	38
PID 2056 wrote to memory of 604	2056	WScript.exe	38
PID 2056 wrote to memory of 604	2056	WScript.exe	38
PID 2056 wrote to memory of 604	2056	WScript.exe	38
PID 604 wrote to memory of 1036	604	svchcst.exe	39
PID 604 wrote to memory of 1036	604	svchcst.exe	39
PID 604 wrote to memory of 1036	604	svchcst.exe	39
PID 604 wrote to memory of 1036	604	svchcst.exe	39
PID 1036 wrote to memory of 1792	1036	WScript.exe	40
PID 1036 wrote to memory of 1792	1036	WScript.exe	40
PID 1036 wrote to memory of 1792	1036	WScript.exe	40
PID 1036 wrote to memory of 1792	1036	WScript.exe	40
PID 1792 wrote to memory of 1624	1792	svchcst.exe	41
PID 1792 wrote to memory of 1624	1792	svchcst.exe	41
PID 1792 wrote to memory of 1624	1792	svchcst.exe	41
PID 1792 wrote to memory of 1624	1792	svchcst.exe	41
PID 1624 wrote to memory of 1804	1624	WScript.exe	44
PID 1624 wrote to memory of 1804	1624	WScript.exe	44
PID 1624 wrote to memory of 1804	1624	WScript.exe	44
PID 1624 wrote to memory of 1804	1624	WScript.exe	44
PID 1804 wrote to memory of 3028	1804	svchcst.exe	45
PID 1804 wrote to memory of 3028	1804	svchcst.exe	45
PID 1804 wrote to memory of 3028	1804	svchcst.exe	45
PID 1804 wrote to memory of 3028	1804	svchcst.exe	45
PID 3064 wrote to memory of 2804	3064	svchcst.exe	47
PID 3064 wrote to memory of 2804	3064	svchcst.exe	47
PID 3064 wrote to memory of 2804	3064	svchcst.exe	47
PID 3064 wrote to memory of 2804	3064	svchcst.exe	47

C:\Users\Admin\AppData\Local\Temp\405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe
"C:\Users\Admin\AppData\Local\Temp\405e30d77e66b697b13c5dd72425fde0980c12a7c3577bafa718f0e06a883048.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        10⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:604
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        12⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        14⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        16⤵
        Loads dropped DLL
        
        PID:3028
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        18⤵
        Loads dropped DLL
        
        PID:2804
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        20⤵
        Loads dropped DLL
        
        PID:2984
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        22⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        22⤵
        Loads dropped DLL
        
        PID:820
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:688
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        24⤵
        Loads dropped DLL
        
        PID:960
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:788
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        26⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1336
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        26⤵
        Loads dropped DLL
        
        PID:1792
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2152
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        28⤵
        Loads dropped DLL
        
        PID:1536
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        30⤵
        Loads dropped DLL
        
        PID:2932
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        32⤵
        Loads dropped DLL
        
        PID:2888
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        34⤵
        Loads dropped DLL
        
        PID:2088
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        36⤵
        Loads dropped DLL
        
        PID:856
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        38⤵
        Loads dropped DLL
        
        PID:1844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        40⤵
        Loads dropped DLL
        
        PID:1304
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:668
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        42⤵
        Loads dropped DLL
        
        PID:1756
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        44⤵
        
        PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 a6b49b4ee1528fd6e42f83d59fafb360b6f936db7619c5f9dd7901a9fb8ea0ca
MD5 78b594f4a6f5adf65b921f6ceac9d101
SHA1 b1b33e79c410e0293a0fb9effb21933259bb9c8a
SHA512 989808e4153653a487d0d90ad3a865ac8ebd6c04df86af7b9550657b4cd54c84aaac6060703ea6a75f5f5c238d333bfb9cd6f86cafb094abdf798db06d127a51
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 5827d14409ed9f3361d81904d50e067223457590dda163a680ce4216e495a3d5
MD5 5f762b3b2477d92959f29d768008d453
SHA1 ceaa2b37d64bcffd7f862a75e1d0fb06edbddb97
SHA512 fd1445d89a0fa5d185ce51442c402d9906fa8bf7c1458a862568ad0649dfa22c5f90ed243b98339ec9706541d244b0217f1cd05e715dc49067e059fe08d80420
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 6251cc562aff44a7222fe555019800d44c515c0319748fae595621d92f5d9236
MD5 ae63ded87a90f9812749cac189d07a57
SHA1 5a37ba565ce8c2445ff71f7c3d7adc38cb68627f
SHA512 293cf9a753b1456071db8840910ec3ee7a0a00342caeb27a3bf7c150b54e51a22673e8262fd4376bad6c29eff3b3a77c1c47c1e10c49abffaba899b9193d9429
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 3eb2bfca11e83ada63c9e426764e07267c058964f959ca5e0c3f0f8933e40026
MD5 70e226fbd8b4b3f2ddf8a8753a77586a
SHA1 a81a39d08f77479d0ee65599dd2749031c32fc19
SHA512 f8c3f2f4172e8cabb856cbc2527dae48cba6d740a8ad9844bb32013ccba200b4c03dfdbe3713d9caa5f7416b8729cba4d516a73989b388c952ab08205b3cd4b8
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 2952c41a53b0569f4005c91e142940e5e96ab915146591fd27e380826de74370
MD5 3612d3ea6472851cf27d0650f30a8461
SHA1 6deb8050a9d5911a2bcaa1dff30442b243389423
SHA512 274ea073a41fbb585172d72f0f3c37132154378212b24cf3609f2bb450d631741c438035f81046ec36f08e62f287949079776d359cd42602ad097cfc0689f49c
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 3c6e5a89529248f6074cab8ca705d7f399c2808e185a451f2520d767e7aecd77
MD5 308b7da7ec377746fab239c88940c7ea
SHA1 62356f1d6078f5587c1e0fa2201b199ebfdd0372
SHA512 bfd886261d3c9ae90f40968acb30b229e8d6754768bee5430f246594b5f81952de101a572cedb84bd1ab9a39cb607ec981287e9e03ea45b829744c47ee9bc877
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 4fc01d17db5185ecf506bb8ad2665dc04fbc85d9b55282b364687c5c82689251
MD5 6cefcde7a292edfc29b3882cdeb23dba
SHA1 3588db649319258acc78049555e0c587aae5dcf1
SHA512 14f7f31813f271f8ab4c58ad06504769900ae075915db76882bce80dfaa82bb76bc6c40fa76f6eae4f3c65d2311a702d5581510ea5ade452ea8b6f957da1684c
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 c69ee4a632cc1c351d5fa930d42546923a4125e7d9cbccb2ad9f9e3318be2b77
MD5 2551ae733b39ac9061a9d5ebd2f29d98
SHA1 08247d27dd5bf959db0b29d3e5b0551dc47c9d02
SHA512 a1c669cb87194c2b496a7131f7f2920b6c31156f88d6c1140e79f3b83fbca3785cd57fea2d47cb951ed576e69a1240e81746a5bc5444e65fd05fa5234125731c
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 7fcd076a55f0b7c8e9407217aee7e68893461d15cb8d2946ac5250af35137211
MD5 24e4a44b907089d788280d647e33c77e
SHA1 ac5a4e397dea243c0022c55319e7c7035d013905
SHA512 c4a8dac1c1d5dfa976cc3e8fd299e423ab620463983b8c602be8a83ecc6598eb3f1d60a7370806e1f85a52dd91e4f1337a6dff2e99459f9a1e429a1ffb65a00b
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 013ba01f27689a865f4497bdab298b8914e8c235beac2311020fa928649a7603
MD5 d44632a3e4cce7689f6de0096ea7b712
SHA1 62726ae2641d71b6a218793f1ca8c00c81443eda
SHA512 ed9934194e0211fca3d30bb16802ae080086a71d4b8b065afecea339f06f4d5dc43f51786059d6ccaf7718a54dde8b050268068ed6a416dacfa6c79a8ba0881a
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 0081c1fe196153e4e7651f0c4a3888bda7623ba8f76218b8df10dc5147d778c0
MD5 b43cc190210c9c6b2742cc52bd8296bc
SHA1 5476b0b4ca6b80be460b3e183f51d50599750324
SHA512 dee2b38b2222020a8fdf2bb241461b3e58978761cfa4c2099184badfc7a98d4acdd0f75d9417a94928a62da7f7c10e9cc04546636e88004897dd3c73cabeed27
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 228b66ed4c4a1270fe5a6655cdd849de937351e95974b96acafa59b8107b7dd4
MD5 951aaea1269f2a203f3dd7cd181c5d34
SHA1 3623d216764b24aa0b02cbc136287252bf5b412a
SHA512 cd84967ad43a13c3cd57cc80f6533a9e9fd93a5eddf4807825b8d19883da4acda3e7b4ff963f23209c579050fedf834382d8e718386c852ceaf350b2b0f91816
MD5 SHA1 SHA512

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 a1fd4ac32dedf9c5925a62f35cfa2db08a8a3139d22658be15ce51ea1395faed
MD5 a42abb275d917cd5905b891ff922ddac
SHA1 bb8d107807b6aeb21095dbf851f6429858756e2b
SHA512 d93607f76f983b00100135d53d7560cfe5e2bde0b78e53a8510bf6f5bed1db9cb763bf097b08784e0c69e36030860499e082bb85dcea591e395e56e8326e1f23
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qu:acallSllG4ZM7QzMF
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 3e0f2b10316663fcf72bd3c2c08e84cce8e109a899b82656d159beaf462388d5
MD5 a367bca4537e4f8de06dc7c08b69bec8
SHA1 2b60597c805946d0a790283ab9f22763b4def2a1
SHA512 5cd9284e5d937432976a267ff142cade0fad733cba47ba79d3e01c91d79aa2281881fdcc87116cccb23b1c9e0bb403736e014138f608003736192047f0d1f813
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qn:acallSllG4ZM7QzMg
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 1d798470e3bea93f53a262039b99b827ca08af51c9c2d9b8a3e1b425dcd89f67
MD5 3690304313332e39797a5585a054ac47
SHA1 812cc1e732fc452f4c4eef827d2b08e40dc60a16
SHA512 7de21658a41be76eb1f3a7c4d111ad32e48a1245c1af6bcb4c52ad45222ae26737b766ea0a3bacb80c4c8d128fcf0d42fa3d6289a753f4256146b39c43fa036c
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QJ:acallSllG4ZM7QzM6
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 3e54fdb081c33b75510196c456d587ddeb0d61e3a41b3136df0fb1807c53a638
MD5 595e4aece06ebfe69533b68d66fadfe1
SHA1 9afe90cd0bb7bef783f21e61acfe97b972ed85b0
SHA512 4ddf5e9005f0a8c263538de596c1c2484e93430d1bb6a6c72e833a296409ee28defd1bfd751b0e4f2ddc2720f25c5794983b2fd8cb69a204f5fd391701a4aa03
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q+:acallSllG4ZM7QzM1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 775d2b7c6aa10df77e806696dafd49398b0d7573e039d350c7481c2701f62408
MD5 1c0143c3e0844573fbcd2ead71cd241c
SHA1 c4fe83d64541779bbe81545c554e1ef3011cd705
SHA512 f612b9be2ebe85d4327cfab7bf07a520baa08b49fb13ded2b22052cf58a7e0f900836e63e72eb48e9dc15e781417de0a5c18e2b0dc906b9194fd83d5667b454f
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QW:acallSllG4ZM7QzMN
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 9193cf6ef2bcbb5faf96e2d19535c71757f2776a2be121804c3b718017cf674e
MD5 261cd59937d52e117f93788122cd5fe3
SHA1 8b566a2ac25abd53515f2acb9d7806f6b7b683cb
SHA512 b6146949089cc8cdfddd946308533d0a4679e34b4914f1d591d5089a7d8d0e7baff0a81b44edc7afdaf4e57eab92c177ec79adb3c040dd2dff9887c45ff2b085
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qv:acallSllG4ZM7QzMI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/604-63-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/604-71-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/668-246-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/668-253-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/688-157-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/688-164-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/788-171-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/788-174-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/856-228-0x00000000044D0000-0x000000000462F000-memory.dmp

Download

memory/960-165-0x00000000043C0000-0x000000000451F000-memory.dmp

Download

memory/960-175-0x0000000005CE0000-0x0000000005E3F000-memory.dmp

Download

memory/960-170-0x00000000043C0000-0x000000000451F000-memory.dmp

Download

memory/1028-155-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1028-147-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1048-44-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1304-245-0x0000000004690000-0x00000000047EF000-memory.dmp

Download

memory/1336-180-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1336-183-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1536-193-0x00000000046D0000-0x000000000482F000-memory.dmp

Download

memory/1576-218-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1576-215-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1624-89-0x00000000059D0000-0x0000000005B2F000-memory.dmp

Download

memory/1624-90-0x00000000059D0000-0x0000000005B2F000-memory.dmp

Download

memory/1640-194-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1640-201-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1740-229-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1740-236-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1756-254-0x0000000005AF0000-0x0000000005C4F000-memory.dmp

Download

memory/1792-84-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1792-76-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1792-184-0x0000000005E60000-0x0000000005FBF000-memory.dmp

Download

memory/1804-92-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1804-99-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1844-237-0x0000000004A10000-0x0000000004B6F000-memory.dmp

Download

memory/1876-244-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1944-227-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1944-140-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1944-224-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2088-219-0x0000000004440000-0x000000000459F000-memory.dmp

Download

memory/2128-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2128-9-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2152-185-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2152-192-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2268-47-0x0000000004430000-0x000000000458F000-memory.dmp

Download

memory/2444-255-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2532-119-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2532-127-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2580-209-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2716-48-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2716-58-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2804-118-0x0000000006110000-0x000000000626F000-memory.dmp

Download

memory/2888-210-0x0000000005B70000-0x0000000005CCF000-memory.dmp

Download

memory/2932-202-0x0000000005B20000-0x0000000005C7F000-memory.dmp

Download

memory/2972-34-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2972-28-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2984-145-0x00000000046E0000-0x000000000483F000-memory.dmp

Download

memory/2984-146-0x00000000046E0000-0x000000000483F000-memory.dmp

Download

memory/3064-102-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3064-115-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3068-18-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3068-24-0x0000000000400000-0x000000000055F000-memory.dmp

Download