Overview

overview

7

Static

static

3

c8e81b11c9...97.exe

windows7-x64

7

c8e81b11c9...97.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10-07-2024 21:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c8e81b11c928d45eee32588d87956f0fab633a88c39c8efdb3a451b6e4351697.exe

  • Size

    1.1MB

  • MD5

    75cbf00b7c64a2a8240828c6696728dd

  • SHA1

    88f1a5977e42da9824cc944b93b61a1b848932e0

  • SHA256

    c8e81b11c928d45eee32588d87956f0fab633a88c39c8efdb3a451b6e4351697

  • SHA512

    f8e7d835c7ba430578f6483f1638fc5c049c014e5fed2e39170ff2735c9e9eff6c165f4378b11127f03099e29728fa7e04645d4366695a416613ca294c2b499f

  • SSDEEP

    24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Q/:CcaClSFlG4ZM7QzMo

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8e81b11c928d45eee32588d87956f0fab633a88c39c8efdb3a451b6e4351697.exe
    "C:\Users\Admin\AppData\Local\Temp\c8e81b11c928d45eee32588d87956f0fab633a88c39c8efdb3a451b6e4351697.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:380
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:628
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2700
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2828
              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2976
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                  8⤵
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:1268
                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1948
                    • C:\Windows\SysWOW64\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                      10⤵
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:2224
                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1968
                        • C:\Windows\SysWOW64\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                          12⤵
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:1616
                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:1028
                            • C:\Windows\SysWOW64\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                              14⤵
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:1716
                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:2544
                                • C:\Windows\SysWOW64\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                  16⤵
                                  • Loads dropped DLL
                                  • Suspicious use of WriteProcessMemory
                                  PID:2396
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2632
                                    • C:\Windows\SysWOW64\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                      18⤵
                                      • Loads dropped DLL
                                      PID:2636
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2052
                                        • C:\Windows\SysWOW64\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                          20⤵
                                          • Loads dropped DLL
                                          PID:1768
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1568
                                            • C:\Windows\SysWOW64\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                              22⤵
                                              • Loads dropped DLL
                                              PID:2300
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2504
                                                • C:\Windows\SysWOW64\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                  24⤵
                                                  • Loads dropped DLL
                                                  PID:1104
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1356
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
    Filesize

    92B

    MD5

    67b9b3e2ded7086f393ebbc36c5e7bca

    SHA1

    e6299d0450b9a92a18cc23b5704a2b475652c790

    SHA256

    44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d

    SHA512

    826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    753B

    MD5

    2f0ee61fe411ea8c33f7fad6b7ef2b9f

    SHA1

    9b3ca4dbf9c9bb7370014dc6936f65ab9fa5590c

    SHA256

    2b1e24c86cc5268f8b9b0485ab1ea5a4cf4d1a552e661c5c7b931eefe26b6cfc

    SHA512

    542820a6559c556e33dfc4d6e7a98b05a0cb1472b4e1047959925cdbfca95d90d75bb71f9fc01bc29605946267e95a51f9dba09e5f70865fcffbbc3528a3fc05

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    696B

    MD5

    73dd42e0ba8cff47f0542d7d8aa40f90

    SHA1

    ffbb1b56415be5abcf4613aed3136768f2edbc38

    SHA256

    c73b4e554a4ae515ae3aa320a19d752e3d848d00ed0cd8f084081ed530b8fc3d

    SHA512

    efd0075f9e70dd557271bdbcd782a083ae2cde8cd5674bf7f8cf63064847951adfcbaa9c9cff91c57d19c7308d0b7bf4754bfbe8fce6ec0e41d920bde7f5a67e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    696B

    MD5

    0e6005a9dcb5a78d6fdd54527602f926

    SHA1

    90adc62e99f3c94c643596af0e17b5853b91fe1f

    SHA256

    847552b1ad30bd72f24acfe4afa5c326d3e79d7c2f147c958d72e92daca716da

    SHA512

    b4acfd81c1e926fcd305690aa3780bbec50460bcf947d17c20d6445faca4e774294b9da3a144207ccb3855e3ea2008a2d82ef691f32a4db6c7c3eb8202c6b568

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    696B

    MD5

    a3b1a2435db9006df38c9e78df96e2f2

    SHA1

    a8a6d302d102686610f54547bdf0245b177a752f

    SHA256

    8ca1784265581709551e81326c9733c10ac943c899070bee9b799f88dad7870e

    SHA512

    fe8a0d2a67e28fcf1b31e640132a669186ddb33302b135d11c0706a5c9e98548d53d51be0d2ecc9d20c43efbe393d7865c57ca9b6c651deca93f67aff0968210

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    696B

    MD5

    2c3b5340da071ac89dded61dffd49fb5

    SHA1

    77a880658d0b70e5455379099427bfdae8cc0ae8

    SHA256

    d7433fbea40ea3f87e991ce54c73436c110cfbb83748d554aea8d94051a5224e

    SHA512

    7e69f14c55afec39149491531c2a499b6253aa71ad448e722912f239fde055826b34383bd8d14773af08ef475b5fe53451a0a93e0bcc46fbeba3872198200f3c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    696B

    MD5

    06a252a9516053e44ec8e64f1ebf0533

    SHA1

    29ac97e0cdade946c4feb81ad3f78d70953a2277

    SHA256

    6b8a799c3d4b977adb7220f6790b2ac09080ca3ccde5a2c33c83b33ea905928c

    SHA512

    0775aabeef7c910e03efc40f96143025a2ee3544dd656c78d09ef63c85d040037752aabe72fdf3b636ee31422ae8de01b73c85e27247203d5efc1635eaf15b2d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    696B

    MD5

    910e8b4a682865877d5b4c6b32ac2db3

    SHA1

    7df0ffdcff6b2f1d51878af2ca989990c399c005

    SHA256

    0eaa114fec2febec98337efcccfbb2863979005935decd44f9cd7db110b33b9f

    SHA512

    eb3e30e57f8ae59dc62d7c7f6c20296c7105a3fead464229b7b037924a20127266c0f09a6090cdeae4bea0f728f6213b2da67b44c3cd85a662c6b0cdf34c24bb

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    696B

    MD5

    344b0286b823cd492e5ca9c83c00ba11

    SHA1

    b76dbac9b5724f5b1e11a10ed7a2125edb16259b

    SHA256

    04ea89515062031f99eb08fad07de798532e0adea7ff18c0c9a8b1e3a1d4dbbd

    SHA512

    9aba17235e4f1bd62f45545cfa0e4f302c0471732b33a8398b462e334126c5a3e74fdcbe17db70029184cc1207f558efc46b868475fb607ad536288b0796bb80

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    696B

    MD5

    30eafc82ac9962314c98d54ef2588957

    SHA1

    3bf1e1f24264448ba2688366b10b083c808e1e7a

    SHA256

    fc93c94af2daa9c8b70b9f6104f613a1cf0ac39bf1856542a3dbb6f828d2bee6

    SHA512

    5cd90109e61e06fda91874fd3cd28d83b42b6e586446ce99cf69a611f0015f56010937fadca4accef57ab47b5bca54b4171479a9a989ab5b1a015d491f985fb5

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    696B

    MD5

    81da78e4c29b5abf222c1425d1b8da16

    SHA1

    c68fae858982c6217d14f0a94f1e424dc47e5abb

    SHA256

    e1c0bac8ec1a6de7acf76dbaae7862a630d01697c06843f75330f8be29261f38

    SHA512

    859ff4f8d8119e4a12c83c8aa7a7c392b9bde66358d189f67f0d44ae6777f75dd7f994536d812cb00f0612a9c4444a3775ff729512d50c1a6173f23b5866fdb0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    fce3c321a9153f606ae6c6770f7ea8d5

    SHA1

    77d8772f5ec688b7734a824a77f84e92a8fe6b9c

    SHA256

    8df207dc6c250ea40aaa791e9b384dedb8126ceebad31eca5177e6bd98a0196f

    SHA512

    c6f3c0875628f59da5a732f094630a2e61ae310bbc6424fab157d1a626323d7f7def82dec3c33bbd3c62255592654eadb3bf7a10c78311c3f4a8d674bd0b57f2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    328b878c4862b66f347de6e37f6cd124

    SHA1

    fb0c4bb4559dbe765b1c34addfa7ecbb30c18f29

    SHA256

    889687e21581e731a9379af1eee24ffa2a3ca2b34d3020ba408ba09377f5933e

    SHA512

    bdbf1bff9848e0b087e5be3a8b2a1ab96e140c695137dfe0abb942d28f10585d229fabd6f784055c5c0c1d720d52010bd1fa76f8423b36c0d9109693871b80de

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    d263c85bd83d0c40ab3601c3f8323f93

    SHA1

    b2875fc1eac7860ec75d41f7d8974ce7276901db

    SHA256

    2d2dda8e0c78328b8ec6ba6ad56e6ccd1100773a792c75e52f8b6c787dc67353

    SHA512

    559283beec074f2378e797dcdab9684cf5d91e35fb2e79db35fe524b83d9baaea4d58d25e642209500822fc431430b60d45e75862bcfccc9fcd59f3917e28f73

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    3934611ce44038994c985fb791dcc0c3

    SHA1

    6a5903d1cc37c8d361db2ad3795c223972fd4bab

    SHA256

    c76c4c0c02dd5080f3471e31764944df860b39f78abb5009d393225a63df9c1d

    SHA512

    2ff7651bff43373ce905c06d6e7bfbe4546fb2513fea7194d5df23bf15f2fdfe88d0302dd13cbc9460b2b44aa53d690ce3985b48e62f7782e1f1df26a2d88519

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    6ac99cc3d459002eb2350e3b4e47f423

    SHA1

    0b7e1b3dd56221a24d4e91ca8279d8324f9b8d46

    SHA256

    5283773bae4f260aecb69ed02e63e0060ff81f5ac0c358c7ecb93d1e105020f3

    SHA512

    edd92b54b7be2ad4fba837ef46276a8e2636bf63207a2678ca6eb5f83fdd0d494f421efdc550a9d7026357a522795bd48b6d30e2e6c569a5f4451fab2813033b

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    4d75e71f8bb5b82881da7c745830ca30

    SHA1

    322e17d4c596c2077a002f91a83d391ce7b9ed79

    SHA256

    a9da322bb035a141657591e564f7bdd4d22cfd109d7c27427912f7aadf1382ec

    SHA512

    28bcc4c51b9893c3a69931dbfd669b4e114dbf0ca8414b44b01ab08c70af16e770371f14ac456922e346fb7a0ed679468275dafe2c767897d9a50f615841881d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    0b89fa782eb0d00317ddf3a66a1ac14d

    SHA1

    82b0fc249161d4f40c907bcff7b20d54eb1fc719

    SHA256

    ede510067d6c5e7d21ca4fa32931048c30a4d35eb893e9dd8a3513dd6b8ced35

    SHA512

    dc7c2599ba99d65aafeec0e41cf574229f16bdde5bcaf1300d4ac651906267cd487fefc079a4fb73b3b6c47cb46d37fd7bddb6ce3b0d63dc33b3e4baa0e97ac0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    f46782b61b5579aa9c1503224006ebff

    SHA1

    8cfa4f0b96e58f3e0711fc84ed117c424ee5883b

    SHA256

    f46b59943d38f667a5a6a9c7e0a313e1ab0727cc442138f9fc1c33b6cc56c659

    SHA512

    714817c02d2454606491b97c9c8072577e878d7a4b08ae81b59a5567f49db68fb576d5f69efd8afd33543218a23162331581a12f9e86c4fe122fe1a38e0534c8

    Download Submit

  • \??\PIPE\srvsvc
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    210d8a271da514b86b10491802457a7a

    SHA1

    5a5dfce21d9a1c9e1f11c09a9553a1a86dec7774

    SHA256

    43cf437c405493b1104b696f6738172f12f38e452260f2735b008b645a378d1b

    SHA512

    6f142726f282f8d8637aa680632620003321abd33b410e859013f4b907c9b3e67ede96cc0951fbb0cb8bb65264c94a166c5127867abb0163a7027e7ccafc6aaf

    Download Submit

  • memory/2884-8-0x0000000000400000-0x0000000000551000-memory.dmp

    Filesize

    1.3MB

    Download