Analysis Overview
SHA256
dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c
Threat Level: Shows suspicious behavior
The file dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c was found to be: Shows suspicious behavior.
Malicious Activity Summary
Checks computer location settings
Deletes itself
Loads dropped DLL
Executes dropped EXE
Enumerates physical storage devices
Unsigned PE
Suspicious behavior: RenamesItself
Suspicious use of SetWindowsHookEx
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 18:36
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 18:36
Reported
2024-06-13 18:39
Platform
win7-20240221-en
Max time kernel
149s
Max time network
122s
Command Line
Signatures
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
Executes dropped EXE
Loads dropped DLL
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c.exe
"C:\Users\Admin\AppData\Local\Temp\dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
Network
Files
memory/2880-0-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 4921a6d4e706155e88ef83d84b5c9bac |
| SHA1 | 5b622eda004a81eeac42c820a35c04e81594cd6a |
| SHA256 | fdb22eb852ea0224376c7569b5de860f61a6db1b966004e81f95ff7578d0610d |
| SHA512 | 2f5f142292874f838ae8f2a61baf2d29fa64933fc8a73a662e7b7e92bf04c97af0581bc022042dcec79bbec85a917bea8518436c235c1cbdec6a342ed207bd83 |
memory/2880-9-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
| MD5 | 8b95ab2f3e7a7db850bbaafc29e4579e |
| SHA1 | d5b09efa21115f65dd1415549b7d69cbbfd18ad7 |
| SHA256 | fbc49f25dd5abde865fef71ae97d7d5d5b7c1d4c405312f5bd41ca53d9abec35 |
| SHA512 | e21ea17048fe77b13d70b8340f4f9c4016d41577b5249516a257c8d9e6475c0eda95e4fa58e7228ecae25ae0a547ec7ee92fe66fa36c09a12bb4d26a1441bbe6 |
memory/2512-15-0x0000000005CF0000-0x0000000005E4F000-memory.dmp
memory/2456-14-0x0000000000400000-0x000000000055F000-memory.dmp
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 463784728a0ab2b8cc52ee1ed0e5258e |
| SHA1 | 620a618c31439d36e8539e50359713befcc28e92 |
| SHA256 | a34e1ed304dca4f58275bdd5daaf071d1767db7bb7ccc6bf2aea2df5e2be023b |
| SHA512 | 52f9736297fbaf65179d35e01c7a15d516d2ff8b5c949a45046bc668bbe94b5da63aea4d5920ebfc1a884721f16fdcae75ea08ca9a6aa78297a44051ed979c7f |
C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
| MD5 | 67b9b3e2ded7086f393ebbc36c5e7bca |
| SHA1 | e6299d0450b9a92a18cc23b5704a2b475652c790 |
| SHA256 | 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d |
| SHA512 | 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09 |
memory/2456-25-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
| MD5 | dfc67a4179ed05fc25648f3141498936 |
| SHA1 | 5b377700a7ff3bd10fce8f0d228d1c3b0a47e004 |
| SHA256 | c6ffac125ea6fe1f92b6a19e8c765649248d63eced1938a1daad71c341448707 |
| SHA512 | 4be2da08c80fbbafdbbee85748a0bf88d50764cbafb574b530ad0a60057fbbcafb70ee1c08e72c2def38c77932e0d13a880759ab08502fe1351b20a1aacf68f8 |
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
| MD5 | 134ee0cfc792227ee37b7980a57d59c9 |
| SHA1 | 15a2cf25bf5fdc237f1d7fa57f0f980348b79e8a |
| SHA256 | d0e6b8c2c0200222759391c0c894bf14b4dfd4155c1470e5a3b2dea91b95e6f1 |
| SHA512 | de7aa16651e4d0ba8161cfe0e4c2111775da231dacc2fa54f9b259e83d68112e7c5d96e2b1a13f7e32693a188aaa3161571ee354e742fbdc5671662eac4b0ffe |
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 24e4a44b907089d788280d647e33c77e |
| SHA1 | ac5a4e397dea243c0022c55319e7c7035d013905 |
| SHA256 | 7fcd076a55f0b7c8e9407217aee7e68893461d15cb8d2946ac5250af35137211 |
| SHA512 | c4a8dac1c1d5dfa976cc3e8fd299e423ab620463983b8c602be8a83ecc6598eb3f1d60a7370806e1f85a52dd91e4f1337a6dff2e99459f9a1e429a1ffb65a00b |
memory/2960-38-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 8cb32754e88999ece2a392d94875313e |
| SHA1 | da0ef4e297872b82db206ebdc4cafefeed2a4e3d |
| SHA256 | 3dc5ae697f3f5a3ffe053412e05a646883c49be29b179039ceadf5f71a595f9d |
| SHA512 | a331a2472d0ef04f4d6a9b41a147020a688c96977feec8d61878f31382af8c27b8e990dc404137475d48f0155d600cc0d6ebe0a5d1cbb60b1fecf364301ebaa7 |
memory/2608-51-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
| MD5 | 5537fc0d500becad2d0e7cc2a78753e4 |
| SHA1 | bb319ae8b581f611c5f392404bbc63b0e9ab1e71 |
| SHA256 | 32dd022654a7648de4550e072ecf22aa78dbd5f96ea3711eb1060dc847990556 |
| SHA512 | 315ef86c076c5d6e391b943a887ff450ced3be68d7b18e0defb513b89d2bae11e7701706739ca38324ffa6040fe4ae7fa8ac6857f91bba9f1383b190d422301a |
memory/2052-56-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 81911744d71ed066085116eec2026095 |
| SHA1 | 47cfe383cd90c80f367d20667fa26cd160507a8f |
| SHA256 | 3154f7fe0c77b8441733285f257a444605ca5badb1148288aa7275033f75d3f5 |
| SHA512 | e64925ee682737251c7d5f42a378a4f6c23a50a07a6811882547567725b59c172da356b235afc977d4c1e8209f5c1ba696b9dd54e7739f67a71c099c031d7396 |
memory/2052-64-0x0000000000400000-0x000000000055F000-memory.dmp
\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
| MD5 | 160e344039fa5cb4235b5a869da648ed |
| SHA1 | 1eef677a79c32309643885bf36b48f815942d76c |
| SHA256 | d3567567352b8c63d6e16ac25687e3d5fcb1d0222bd7312639162f090d21dd39 |
| SHA512 | aab980f746c269da7f92844578c9085fa1c48b467a350ed11ff555309d87b9459827f60a80e4effccac5f4b5745b263b81ab990e2c3b19ddff40f08ae4ffa43f |
memory/1480-74-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 93bffb400f506fbd69421b6075802c65 |
| SHA1 | b9d8c4ea6a8fd739f6cf167e1f58412525f15784 |
| SHA256 | 2e455d4d9ba6db3056e273b33c3cc67d60d76c4a750b98b2d4d0e2bcc6aa57b1 |
| SHA512 | e00a5d4ad19c488dc18e50150fcd50505133666e333f12f9e0cb3a894162951e4195886798de3531561ff99b4a3fbca6fb351f1ff0bcd0e1ac20cd685962ec23 |
memory/1480-78-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1780-81-0x0000000004800000-0x000000000495F000-memory.dmp
memory/1548-83-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 03f68343f5906993640e0b9e3f9c7964 |
| SHA1 | 699e9c3fda1aa89e7a47ac8b77b41178c99cc8e2 |
| SHA256 | dd2d5bf380874e81adc5e05b667047dcf1b6c8a8953068fb177053e20c35f727 |
| SHA512 | 76de9e035c0ad6ee3237006749fd28ee93a6fcd09700e265aaea432f7d2292aac87f0799221559caacd6dd58ff72af17d67627aace77bd2a36a802bbdc88b99c |
memory/1548-89-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1056-93-0x0000000004900000-0x0000000004A5F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 423a0fabd3a9fd2cbedc3aba67c69650 |
| SHA1 | 880097557ac6718e93822ac7efc9a3e2986c51de |
| SHA256 | d77f549afde3b88ac747c3d0dee3069f914fac77b572ae08737ffc05f696491b |
| SHA512 | c65d3db8250c7885b05075ebc3485db4506dde6c435247ad6a86e9085d59b039f4629583b327662a2eb40c79bc135d5d17b5bfb01f63ee02726aa57ecd7ed139 |
memory/2212-101-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
| MD5 | 725beaa7b202aa6aea3212a6a1376bc9 |
| SHA1 | e805dbb7212be2e328464bfc23b49b023d4ef019 |
| SHA256 | aec790250e9b5688d69e11c867335f2dad6a9b62ad05b372311a0e0a7e117ea7 |
| SHA512 | 04a593f550800416bf7d587b5f85d89d0c8d7708f6f7f7841e7aacf2dfc95ea7e86e8860b32ceb21d56cbe83a588b94ce73e79f205f01e06451c9353c0228000 |
memory/2536-107-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1056-105-0x0000000004870000-0x00000000049CF000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 2caa2e102cde23b48c1d5a47d901c3ff |
| SHA1 | 715fcb390ad3d9016885ab48ea99b2e204d1989b |
| SHA256 | 8e1f14065ac316ee2fcefab057390fe8b1ec88d9c35536f0755204ddf0d84ada |
| SHA512 | 9f6b298b5becff9b0af67c3181177876366db57d8d48ad3974dffa4f61fe7512b68d770e518d08d59c58d2707c52bd78930d2e36f00ef06f0a26d208e5372ae3 |
memory/2536-115-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2504-122-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 9e8dca236ce949019c46b94428612ac9 |
| SHA1 | 0917050afcbb7b94fce6fbb9827fb57de7432b0b |
| SHA256 | bd9f06dbb8f2165c3b75da289ad7983f0c57328d236b2c68a2b5798188874fb3 |
| SHA512 | 23ce9deba9286cbb24c1725503542b63d7e44ea7ada302e5aba6595f84398e2162008d7431f842cccfb2b8fae126216d85c566931d5fcc8c8c5625e2c05f44d6 |
memory/2504-126-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2604-130-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 4433cc23fc280ad8dcff9966bac19fe4 |
| SHA1 | 62cc2abfe6e2ee0fd6b5cbce20daff4ba787bff0 |
| SHA256 | ca7cfd972b03d0b30404c8233125adda1dacc81a2e43e919d70bf1c2700af55b |
| SHA512 | 6a5e7454dde98251a987bedc21e628550c469480cbe41f3b3644789da38e782c8b94660d4a076697cc7abf3fcc767650d00ac3639b11cfeba96ece8110920b4f |
memory/2604-139-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2844-142-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | d44632a3e4cce7689f6de0096ea7b712 |
| SHA1 | 62726ae2641d71b6a218793f1ca8c00c81443eda |
| SHA256 | 013ba01f27689a865f4497bdab298b8914e8c235beac2311020fa928649a7603 |
| SHA512 | ed9934194e0211fca3d30bb16802ae080086a71d4b8b065afecea339f06f4d5dc43f51786059d6ccaf7718a54dde8b050268068ed6a416dacfa6c79a8ba0881a |
memory/2844-150-0x0000000000400000-0x000000000055F000-memory.dmp
memory/324-155-0x0000000000400000-0x000000000055F000-memory.dmp
memory/324-158-0x0000000000400000-0x000000000055F000-memory.dmp
memory/400-159-0x0000000000400000-0x000000000055F000-memory.dmp
memory/400-166-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1032-171-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1032-174-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2360-175-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2360-182-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1620-184-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2036-183-0x0000000004500000-0x000000000465F000-memory.dmp
memory/1620-191-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2908-192-0x0000000005960000-0x0000000005ABF000-memory.dmp
memory/1504-193-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1504-200-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3020-205-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3020-208-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2964-213-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2964-216-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2664-217-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2664-224-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1692-229-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1692-232-0x0000000000400000-0x000000000055F000-memory.dmp
memory/288-233-0x0000000006080000-0x00000000061DF000-memory.dmp
memory/2916-238-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2916-241-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1960-242-0x0000000004630000-0x000000000478F000-memory.dmp
memory/1960-243-0x0000000004630000-0x000000000478F000-memory.dmp
memory/2236-244-0x0000000000400000-0x000000000055F000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 18:36
Reported
2024-06-13 18:39
Platform
win10v2004-20240508-en
Max time kernel
52s
Max time network
51s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\WScript.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\WScript.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\WScript.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings | C:\Users\Admin\AppData\Local\Temp\dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Windows\SysWOW64\WScript.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Windows\SysWOW64\WScript.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Windows\SysWOW64\WScript.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c.exe
"C:\Users\Admin\AppData\Local\Temp\dc4506cdc1b3bec674fdfd83efeea695907bb85664b4ff1ead14a6af3f84564c.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
Network
Files
memory/4716-0-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | 6646c0f409e0bb505a6faa8bd94ff1ee |
| SHA1 | ef09fd147d06b8d26303584495967b40d403b349 |
| SHA256 | 512e5f94e790159720e97d5d09d85010a137551891d25bb81ee017417ea29833 |
| SHA512 | 0dbb6aa3021573c9bc9d922f8685929d7931de45321817ff43f83da01841bc9e55720bf3dd165ec3c5f3250b26cbda16c3338efa752f8e1daf6eef9cde729ffd |
memory/4716-9-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
| MD5 | 0628af060a2eb8c9375cff8bced78559 |
| SHA1 | 8986435140d564a27ab685a694048e4ca804e736 |
| SHA256 | c2c6ed52c39d84ba26da98a2e45f299f5f91e103c462b82d177e7ff79071ac7a |
| SHA512 | 0dd2721ccc54a3d73ad3a5d895274ae87b9b1d1a833061b7b6dc92f14ac1755db68796e90fd3f9a6b1440cfae729ea93e3d7ac62783297925215430c7abfada9 |
memory/3256-12-0x0000000000400000-0x000000000055F000-memory.dmp
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
| MD5 | c85adfb789ee03eba0d843b08042e4db |
| SHA1 | 263793011d11bd0dd1daf4b55215a8802f9bf6e2 |
| SHA256 | 8cc7784dcb4efa452913063eacec257cd1b6577c80bb3540f7cfcc48320dbf59 |
| SHA512 | b52184fa3c8a36d8e9293921a40820991247bbd203aa991678dafcd5cc96af20bf2df3e0b876b77a0d6a91f5b43aa2768137f88fca28357f883410d3b9f77539 |
C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
| MD5 | 67b9b3e2ded7086f393ebbc36c5e7bca |
| SHA1 | e6299d0450b9a92a18cc23b5704a2b475652c790 |
| SHA256 | 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d |
| SHA512 | 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09 |
memory/3256-24-0x0000000000400000-0x000000000055F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
| MD5 | 560dcd167648a2c6261e1161bf7589e6 |
| SHA1 | 4e3c756b201a09bdbea257a02a1295c8a3b9237d |
| SHA256 | 77a8eff43e3834b57c34b9f9f6a8561a679a2132387015a7974b0ebacbf3486f |
| SHA512 | bde87a3381cd1dd390adf86e9ea08e9d64111026da197893cd7e8d56ebd32cdacffe76a24d11f43ea80eecaad00aefca838d2f8c58a19c901ad1f524ed7bf66f |
memory/4180-27-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3124-29-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3124-30-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4180-31-0x0000000000400000-0x000000000055F000-memory.dmp