Analysis
-
max time kernel
106s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 01:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fe58d8cca2567d7107f8d6fe0ef87b0N.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
3fe58d8cca2567d7107f8d6fe0ef87b0N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
3fe58d8cca2567d7107f8d6fe0ef87b0N.exe
-
Size
97KB
-
MD5
3fe58d8cca2567d7107f8d6fe0ef87b0
-
SHA1
dc36fa4b6d25a5d01028933fd94b0f0ed423b1b3
-
SHA256
1b7e8879bb5c9351148eb6c5e4d7de3becc8195ddd21d772e701683a6684f89f
-
SHA512
57e81d8619eb1b0a122b9b4e00760386bf63e25bb2ac0ffca441bf97a9bfde3df3b2758b15f9dac35476572e8a5f77c36b8cfe26a5af3c143935174e4f395bf3
-
SSDEEP
1536:oPQc0IiI+7vAIIzuQ8Tr15WUkTdIOzq0ZDsnJvx/JWTRDDxTxp:CQc01zAf6QGkBIO20ZKvbMRDt
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winvsp.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation winvsp.exe -
Executes dropped EXE 6 IoCs
pid Process 2928 winvsp.exe 1272 winvsp.exe 3256 winvsp.exe 2996 wmcsp.exe 3448 winvsp.exe 1996 svcvsp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winvsp = "c:\\windows\\system32\\winvsp.exe" 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winvsp = "c:\\windows\\system32\\winvsp.exe" winvsp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vspmem = "c:\\windows\\system32\\vspmem.exe" winvsp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcvsp = "c:\\windows\\system32\\svcvsp.exe" winvsp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vspmem = "c:\\windows\\system32\\vspmem.exe" winvsp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmcsp = "c:\\windows\\system32\\wmcsp.exe" winvsp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vspmem = "c:\\windows\\system32\\vspmem.exe" 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmcsp = "c:\\windows\\system32\\wmcsp.exe" 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcvsp = "c:\\windows\\system32\\svcvsp.exe" 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmcsp = "c:\\windows\\system32\\wmcsp.exe" winvsp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcvsp = "c:\\windows\\system32\\svcvsp.exe" winvsp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winvsp = "c:\\windows\\system32\\winvsp.exe" winvsp.exe -
Drops file in System32 directory 63 IoCs
description ioc Process File opened for modification \??\c:\windows\system32\RCX7267.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX728B.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification C:\Windows\system32\svcvsp.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7FD9.tmp winvsp.exe File opened for modification C:\Windows\system32\winvsp.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7FB3.tmp winvsp.exe File opened for modification \??\c:\windows\system32\vspconsole.exe winvsp.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\winvsp.exe.log winvsp.exe File created \??\c:\windows\system32\vspconsole.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File created \??\c:\windows\system32\vspmng.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX7FB2.tmp winvsp.exe File opened for modification \??\c:\windows\system32\wmcsp.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7FC6.tmp winvsp.exe File created \??\c:\windows\system32\winvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\vspmem.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\svcvsp.exe winvsp.exe File opened for modification \??\c:\windows\system32\vspconsole.exe winvsp.exe File opened for modification \??\c:\windows\system32\dvm.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7FD8.tmp winvsp.exe File opened for modification \??\c:\windows\system32\winvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX7279.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX729C.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\wmcsp.exe winvsp.exe File opened for modification C:\Windows\system32\dvm.exe winvsp.exe File opened for modification \??\c:\windows\system32\vspconsole.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\winvsp.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7233.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\vspmem.exe winvsp.exe File opened for modification \??\c:\windows\system32\vspmng.exe winvsp.exe File opened for modification C:\Windows\system32\vspmng.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7FA2.tmp winvsp.exe File created \??\c:\windows\system32\wmcsp.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7FD7.tmp winvsp.exe File created \??\c:\windows\system32\wmcsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File created \??\c:\windows\system32\svcvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\winvsp.exe winvsp.exe File opened for modification C:\Windows\system32\vspconsole.exe winvsp.exe File opened for modification \??\c:\windows\system32\vspmem.exe winvsp.exe File created \??\c:\windows\system32\dvm.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\dvm.exe winvsp.exe File created \??\c:\windows\system32\vspmem.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX7255.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX727A.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification C:\Windows\system32\vspmem.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7F81.tmp winvsp.exe File opened for modification \??\c:\windows\system32\vspmng.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7256.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\svcvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\dvm.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification C:\Windows\system32\wmcsp.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7FC5.tmp winvsp.exe File opened for modification \??\c:\windows\system32\RCX728A.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX7FC4.tmp winvsp.exe File opened for modification \??\c:\windows\system32\RCX7FDA.tmp winvsp.exe File opened for modification \??\c:\windows\system32\RCX7245.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX7278.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\vspmng.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX7213.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\svcvsp.exe winvsp.exe File opened for modification \??\c:\windows\system32\RCX7244.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\wmcsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX729D.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\system32\RCX7E96.tmp winvsp.exe -
Drops file in Program Files directory 42 IoCs
description ioc Process File opened for modification \??\c:\program files\vspmng.exe winvsp.exe File opened for modification \??\c:\program files\RCX7319.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\vspmem.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\RCX732E.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File created \??\c:\program files\vspmng.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\wmcsp.exe winvsp.exe File opened for modification \??\c:\program files\RCX8038.tmp winvsp.exe File created \??\c:\program files\vspmem.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\wmcsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\svcvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\vspmng.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\winvsp.exe winvsp.exe File opened for modification \??\c:\program files\RCX804A.tmp winvsp.exe File opened for modification \??\c:\program files\RCX731A.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File created \??\c:\program files\vspconsole.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\vspmng.exe winvsp.exe File opened for modification \??\c:\program files\RCX8039.tmp winvsp.exe File opened for modification \??\c:\program files\RCX731B.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\dvm.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\winvsp.exe winvsp.exe File opened for modification \??\c:\program files\svcvsp.exe winvsp.exe File created \??\c:\program files\svcvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\dvm.exe winvsp.exe File opened for modification \??\c:\program files\RCX804C.tmp winvsp.exe File opened for modification \??\c:\program files\wmcsp.exe winvsp.exe File opened for modification \??\c:\program files\RCX803A.tmp winvsp.exe File opened for modification \??\c:\program files\vspconsole.exe winvsp.exe File opened for modification \??\c:\program files\RCX8037.tmp winvsp.exe File opened for modification \??\c:\program files\vspmem.exe winvsp.exe File created \??\c:\program files\winvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\winvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File created \??\c:\program files\wmcsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\RCX732D.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\vspmem.exe winvsp.exe File opened for modification \??\c:\program files\dvm.exe winvsp.exe File opened for modification \??\c:\program files\RCX804B.tmp winvsp.exe File opened for modification \??\c:\program files\RCX732C.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\vspconsole.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File created \??\c:\program files\dvm.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\RCX732F.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\program files\svcvsp.exe winvsp.exe File opened for modification \??\c:\program files\vspconsole.exe winvsp.exe -
Drops file in Windows directory 56 IoCs
description ioc Process File opened for modification \??\c:\windows\svcvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\winvsp.exe winvsp.exe File created \??\c:\windows\vspmem.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\wmcsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\winvsp.exe winvsp.exe File opened for modification \??\c:\windows\RCX7FFD.tmp winvsp.exe File opened for modification \??\c:\windows\RCX8011.tmp winvsp.exe File opened for modification \??\c:\windows\RCX72C1.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX72D3.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\wmcsp.exe winvsp.exe File opened for modification \??\c:\windows\RCX7FEA.tmp winvsp.exe File opened for modification \??\c:\windows\RCX7307.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\svcvsp.exe winvsp.exe File opened for modification \??\c:\windows\vspmem.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\vspmem.exe winvsp.exe File opened for modification \??\c:\windows\RCX8012.tmp winvsp.exe File opened for modification \??\c:\windows\RCX8023.tmp winvsp.exe File opened for modification \??\c:\windows\RCX72AF.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX72B1.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX72D5.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\wmcsp.exe winvsp.exe File created \??\c:\windows\dvm.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX7FFF.tmp winvsp.exe File opened for modification \??\c:\windows\RCX729E.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\vspconsole.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\dvm.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX800F.tmp winvsp.exe File opened for modification \??\c:\windows\vspconsole.exe winvsp.exe File opened for modification \??\c:\windows\RCX7FEB.tmp winvsp.exe File opened for modification \??\c:\windows\RCX8026.tmp winvsp.exe File opened for modification \??\c:\windows\winvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX72C2.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\vspmng.exe winvsp.exe File opened for modification \??\c:\windows\RCX8024.tmp winvsp.exe File created \??\c:\windows\vspmng.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\vspmem.exe winvsp.exe File opened for modification \??\c:\windows\vspconsole.exe winvsp.exe File opened for modification \??\c:\windows\vspmng.exe winvsp.exe File opened for modification \??\c:\windows\RCX8025.tmp winvsp.exe File created \??\c:\windows\winvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File created \??\c:\windows\vspconsole.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX7317.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX7318.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\vspmng.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX7FFC.tmp winvsp.exe File opened for modification \??\c:\windows\RCX7FFE.tmp winvsp.exe File opened for modification \??\c:\windows\svcvsp.exe winvsp.exe File opened for modification \??\c:\windows\RCX8010.tmp winvsp.exe File opened for modification \??\c:\windows\RCX72B0.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File created \??\c:\windows\svcvsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX72D4.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\dvm.exe winvsp.exe File opened for modification \??\c:\windows\dvm.exe winvsp.exe File created \??\c:\windows\wmcsp.exe 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX72E5.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe File opened for modification \??\c:\windows\RCX72E6.tmp 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" winvsp.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" winvsp.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" winvsp.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" winvsp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced winvsp.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winvsp.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden = "2" winvsp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ winvsp.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2996 wmcsp.exe 2996 wmcsp.exe 1996 svcvsp.exe 1996 svcvsp.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2928 winvsp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2996 wmcsp.exe Token: SeDebugPrivilege 1996 svcvsp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4892 wrote to memory of 4880 4892 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe 85 PID 4892 wrote to memory of 4880 4892 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe 85 PID 4892 wrote to memory of 2928 4892 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe 86 PID 4892 wrote to memory of 2928 4892 3fe58d8cca2567d7107f8d6fe0ef87b0N.exe 86 PID 1272 wrote to memory of 3256 1272 winvsp.exe 89 PID 1272 wrote to memory of 3256 1272 winvsp.exe 89 PID 1272 wrote to memory of 2996 1272 winvsp.exe 90 PID 1272 wrote to memory of 2996 1272 winvsp.exe 90 PID 2928 wrote to memory of 3448 2928 winvsp.exe 93 PID 2928 wrote to memory of 3448 2928 winvsp.exe 93 PID 2928 wrote to memory of 1996 2928 winvsp.exe 94 PID 2928 wrote to memory of 1996 2928 winvsp.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fe58d8cca2567d7107f8d6fe0ef87b0N.exe"C:\Users\Admin\AppData\Local\Temp\3fe58d8cca2567d7107f8d6fe0ef87b0N.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\3fe58d8cca2567d7107f8d6fe0ef87b0N.exe"C:\Users\Admin\AppData\Local\Temp\3fe58d8cca2567d7107f8d6fe0ef87b0N.exe" rg2⤵
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
PID:4880
-
-
C:\programdata\winvsp.exe"C:\programdata\winvsp.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\programdata\winvsp.exe"C:\programdata\winvsp.exe" rg3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
PID:3448
-
-
C:\Users\Admin\Documents\svcvsp.exe"C:\Users\Admin\Documents\svcvsp.exe" wm 29283⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
-
C:\programdata\winvsp.exe"C:\programdata\winvsp.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\programdata\winvsp.exe"C:\programdata\winvsp.exe" rg2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3256
-
-
C:\windows\system32\wmcsp.exe"C:\windows\system32\wmcsp.exe" ws 1272 winvsp2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29B
MD507d4c0c3bd4031c325814063946ddfd9
SHA112c200bb85943ef2d3e602f8c6ee890c0d01aea5
SHA2564b49d4c40e59c8f82ae9a1bc6ed8c83b3df58167c4d2786650ef6323464ddf0a
SHA51216f6f6819208fbe09ffa51592f2da284b602c45b421eadd823c0214efe9273b656bd81d37cb4dd537e8a76b0ef63f7a86d971b370f0eb020bf8d11d811fa3c0e
-
Filesize
97KB
MD5c721a9a6d35ee56779e8665b52fc78f5
SHA1ed17afc518caf8767a0d9f12c3c4d4ebc2d1efff
SHA256e392059660090f64f25d3d6355fe76ce84caf3bcd9454e8e83b2f12d7ecd0b37
SHA51224f3748eec00f3424731e71d8087ac2a7a11d323e80a1bb39e5e319b654474e0b2d3c005d18514b0836cf097e3eda50205663fa8c1c1afb3148f127c45dabe24
-
Filesize
98KB
MD592211052d4af7274836bfdb686b542bc
SHA1344225507e1c04c8e8247eb93f31264640a710b7
SHA2569b8e87b085c72e8f9f5c0defcd5f71743be796133b7dcf2b05f6e2902e7ddf4f
SHA512c792747bc3b64d35d7b3a43dadedc6c4defb1c4cfc1c176fc45297584643c37b984f6de40202017f69cd7a40c04ec75600b884dd30150e1cb118532ee8da95a8
-
Filesize
115B
MD55f2253957958934a8b81921678832b72
SHA1d9b030f94a9f3323fdcdb391192960d840b89723
SHA256ab70783e426113082348a647ea0de73875931662f82b9f2ea4f3a44e5fac1000
SHA51228310f23b744a03f81707d7fb77a9f5fce621bcfc56108b9ff76bbdb4ebc6014380715fef68c8b3c486c9aa4bfc1e66928caa7294bea4d263a18ab8557a96460
-
Filesize
96KB
MD5d444fba1a78ff8a92d82b7e5f77ad398
SHA11e124ebaef81aef959db26f52ae1fa4222743cc5
SHA25620076e3d852e3725fdccadcc60b57dbb7d5af65314bc5117d457e9d8622ee69c
SHA512ad7fe2df1b024eedb2a9c847a9485c787f0119a185a59ea115ce287e7ab1d5b16580a9b52c5b0ececa31c3ed3473ae71e5f4aa9940faf9693efce9d7a348faa4
-
Filesize
97KB
MD56c6bd459e2ee72de2be769ce7c6c5106
SHA1c32a5b4e9dc474a1239169bce699f545534aed85
SHA256599ee121887328287c1806513ea9404211d7fe0efaf23096333647f09099b528
SHA5127151f72c7f57daf253cbb46365e2941da23d05b12efbce510d01153547034e88999f11dd396016f69f98307d9b96e5923840b85558b601cb869c5f845569844e
-
Filesize
97KB
MD53fe58d8cca2567d7107f8d6fe0ef87b0
SHA1dc36fa4b6d25a5d01028933fd94b0f0ed423b1b3
SHA2561b7e8879bb5c9351148eb6c5e4d7de3becc8195ddd21d772e701683a6684f89f
SHA51257e81d8619eb1b0a122b9b4e00760386bf63e25bb2ac0ffca441bf97a9bfde3df3b2758b15f9dac35476572e8a5f77c36b8cfe26a5af3c143935174e4f395bf3