Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe
Resource
win10v2004-20240802-en
General
-
Target
b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe
-
Size
1.1MB
-
MD5
58bf159be8449845d776de671852081a
-
SHA1
3d9094e301b57977f5102cc2ccc72be614fc03b9
-
SHA256
b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76
-
SHA512
0d2b2dcfb634dfaf3702e6ce5f3998c174f981699d6d57b451943354aa327b81a4aaff3c1ec33e24e1e8329268b891ab7b7596d382738c1207e618ab0cd7da18
-
SSDEEP
24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QJ:acallSllG4ZM7QzM6
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1588 svchcst.exe -
Executes dropped EXE 34 IoCs
pid Process 2740 svchcst.exe 2168 svchcst.exe 2668 svchcst.exe 2112 svchcst.exe 1192 svchcst.exe 620 svchcst.exe 2088 svchcst.exe 2116 svchcst.exe 1392 svchcst.exe 2916 svchcst.exe 1588 svchcst.exe 2592 svchcst.exe 988 svchcst.exe 1748 svchcst.exe 1580 svchcst.exe 2884 svchcst.exe 2328 svchcst.exe 1956 svchcst.exe 2104 svchcst.exe 3064 svchcst.exe 1876 svchcst.exe 1540 svchcst.exe 3016 svchcst.exe 2848 svchcst.exe 2864 svchcst.exe 2992 svchcst.exe 2120 svchcst.exe 3036 svchcst.exe 1224 svchcst.exe 1708 svchcst.exe 916 svchcst.exe 2788 svchcst.exe 1780 svchcst.exe 2764 svchcst.exe -
Loads dropped DLL 58 IoCs
pid Process 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2528 WScript.exe 2708 WScript.exe 2708 WScript.exe 1936 WScript.exe 1936 WScript.exe 2964 WScript.exe 2964 WScript.exe 2108 WScript.exe 3068 WScript.exe 3068 WScript.exe 2192 WScript.exe 2192 WScript.exe 2344 WScript.exe 2344 WScript.exe 2576 WScript.exe 2576 WScript.exe 2376 WScript.exe 2376 WScript.exe 1960 WScript.exe 1960 WScript.exe 668 WScript.exe 668 WScript.exe 3056 WScript.exe 3056 WScript.exe 2100 WScript.exe 2100 WScript.exe 2084 WScript.exe 2084 WScript.exe 2488 WScript.exe 2488 WScript.exe 2012 WScript.exe 2012 WScript.exe 2208 WScript.exe 2208 WScript.exe 1208 WScript.exe 1208 WScript.exe 2748 WScript.exe 2748 WScript.exe 1444 WScript.exe 1444 WScript.exe 1540 WScript.exe 1540 WScript.exe 1520 WScript.exe 1520 WScript.exe 2988 WScript.exe 2988 WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 61 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1640 b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe 1640 b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1640 b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1640 b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe 1640 b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe 2740 svchcst.exe 2740 svchcst.exe 2168 svchcst.exe 2168 svchcst.exe 2668 svchcst.exe 2668 svchcst.exe 2112 svchcst.exe 2112 svchcst.exe 1192 svchcst.exe 1192 svchcst.exe 620 svchcst.exe 620 svchcst.exe 2088 svchcst.exe 2088 svchcst.exe 2116 svchcst.exe 2116 svchcst.exe 1392 svchcst.exe 1392 svchcst.exe 2916 svchcst.exe 2916 svchcst.exe 1588 svchcst.exe 1588 svchcst.exe 2592 svchcst.exe 2592 svchcst.exe 988 svchcst.exe 988 svchcst.exe 1748 svchcst.exe 1748 svchcst.exe 1580 svchcst.exe 1580 svchcst.exe 2884 svchcst.exe 2884 svchcst.exe 2328 svchcst.exe 2328 svchcst.exe 1956 svchcst.exe 1956 svchcst.exe 2104 svchcst.exe 2104 svchcst.exe 3064 svchcst.exe 3064 svchcst.exe 1876 svchcst.exe 1876 svchcst.exe 1540 svchcst.exe 1540 svchcst.exe 3016 svchcst.exe 3016 svchcst.exe 2848 svchcst.exe 2848 svchcst.exe 2864 svchcst.exe 2864 svchcst.exe 2992 svchcst.exe 2992 svchcst.exe 2120 svchcst.exe 2120 svchcst.exe 3036 svchcst.exe 3036 svchcst.exe 1224 svchcst.exe 1224 svchcst.exe 1708 svchcst.exe 1708 svchcst.exe 916 svchcst.exe 916 svchcst.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2528 1640 b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe 30 PID 1640 wrote to memory of 2528 1640 b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe 30 PID 1640 wrote to memory of 2528 1640 b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe 30 PID 1640 wrote to memory of 2528 1640 b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe 30 PID 2528 wrote to memory of 2740 2528 WScript.exe 32 PID 2528 wrote to memory of 2740 2528 WScript.exe 32 PID 2528 wrote to memory of 2740 2528 WScript.exe 32 PID 2528 wrote to memory of 2740 2528 WScript.exe 32 PID 2528 wrote to memory of 2168 2528 WScript.exe 33 PID 2528 wrote to memory of 2168 2528 WScript.exe 33 PID 2528 wrote to memory of 2168 2528 WScript.exe 33 PID 2528 wrote to memory of 2168 2528 WScript.exe 33 PID 2528 wrote to memory of 2668 2528 WScript.exe 34 PID 2528 wrote to memory of 2668 2528 WScript.exe 34 PID 2528 wrote to memory of 2668 2528 WScript.exe 34 PID 2528 wrote to memory of 2668 2528 WScript.exe 34 PID 2528 wrote to memory of 2112 2528 WScript.exe 35 PID 2528 wrote to memory of 2112 2528 WScript.exe 35 PID 2528 wrote to memory of 2112 2528 WScript.exe 35 PID 2528 wrote to memory of 2112 2528 WScript.exe 35 PID 2528 wrote to memory of 1192 2528 WScript.exe 36 PID 2528 wrote to memory of 1192 2528 WScript.exe 36 PID 2528 wrote to memory of 1192 2528 WScript.exe 36 PID 2528 wrote to memory of 1192 2528 WScript.exe 36 PID 2528 wrote to memory of 620 2528 WScript.exe 37 PID 2528 wrote to memory of 620 2528 WScript.exe 37 PID 2528 wrote to memory of 620 2528 WScript.exe 37 PID 2528 wrote to memory of 620 2528 WScript.exe 37 PID 2528 wrote to memory of 2088 2528 WScript.exe 38 PID 2528 wrote to memory of 2088 2528 WScript.exe 38 PID 2528 wrote to memory of 2088 2528 WScript.exe 38 PID 2528 wrote to memory of 2088 2528 WScript.exe 38 PID 2528 wrote to memory of 2116 2528 WScript.exe 39 PID 2528 wrote to memory of 2116 2528 WScript.exe 39 PID 2528 wrote to memory of 2116 2528 WScript.exe 39 PID 2528 wrote to memory of 2116 2528 WScript.exe 39 PID 2528 wrote to memory of 1392 2528 WScript.exe 40 PID 2528 wrote to memory of 1392 2528 WScript.exe 40 PID 2528 wrote to memory of 1392 2528 WScript.exe 40 PID 2528 wrote to memory of 1392 2528 WScript.exe 40 PID 2528 wrote to memory of 2916 2528 WScript.exe 41 PID 2528 wrote to memory of 2916 2528 WScript.exe 41 PID 2528 wrote to memory of 2916 2528 WScript.exe 41 PID 2528 wrote to memory of 2916 2528 WScript.exe 41 PID 2528 wrote to memory of 1588 2528 WScript.exe 43 PID 2528 wrote to memory of 1588 2528 WScript.exe 43 PID 2528 wrote to memory of 1588 2528 WScript.exe 43 PID 2528 wrote to memory of 1588 2528 WScript.exe 43 PID 1588 wrote to memory of 2708 1588 svchcst.exe 44 PID 1588 wrote to memory of 2708 1588 svchcst.exe 44 PID 1588 wrote to memory of 2708 1588 svchcst.exe 44 PID 1588 wrote to memory of 2708 1588 svchcst.exe 44 PID 2708 wrote to memory of 2592 2708 WScript.exe 45 PID 2708 wrote to memory of 2592 2708 WScript.exe 45 PID 2708 wrote to memory of 2592 2708 WScript.exe 45 PID 2708 wrote to memory of 2592 2708 WScript.exe 45 PID 2592 wrote to memory of 1936 2592 svchcst.exe 46 PID 2592 wrote to memory of 1936 2592 svchcst.exe 46 PID 2592 wrote to memory of 1936 2592 svchcst.exe 46 PID 2592 wrote to memory of 1936 2592 svchcst.exe 46 PID 1936 wrote to memory of 988 1936 WScript.exe 47 PID 1936 wrote to memory of 988 1936 WScript.exe 47 PID 1936 wrote to memory of 988 1936 WScript.exe 47 PID 1936 wrote to memory of 988 1936 WScript.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe"C:\Users\Admin\AppData\Local\Temp\b23ba60000e2ba57eadb6adec35cc24842d96c18a61160f6fefb9500b7b54c76.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2740
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2168
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2668
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2112
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1192
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:620
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2088
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2116
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1392
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2916
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:988 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1580 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"10⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2884 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2328 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"14⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1956 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"16⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2104 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"18⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3064 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"20⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1876 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"22⤵
- System Location Discovery: System Language Discovery
PID:936
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"20⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:668 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1540 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3056 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3016 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"24⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2848 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"26⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2084 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2864 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"28⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2488 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2992 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"30⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2012 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2120 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2208 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3036 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"34⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1208 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1224 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"36⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2748 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1708 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"38⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1444 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:916 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"40⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"44⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"46⤵
- System Location Discovery: System Language Discovery
PID:1976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD567b9b3e2ded7086f393ebbc36c5e7bca
SHA1e6299d0450b9a92a18cc23b5704a2b475652c790
SHA25644063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
SHA512826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
-
Filesize
753B
MD5d798ea571b4d8832005562c44bdb2c05
SHA1f932852691bdc84a6619d8052a3025f1637107ba
SHA256ec583806585f72f38afd021574b260b50ad66913a774a782051ad9bfa19e10e0
SHA51258dffc272653d756f7f8c490c354a7bd70fc1a9917560285800b81f2ae49c2a2ece6307ac2af2f176efbdbf8064bc9552f0654440a15895135e99f262e78731a
-
Filesize
696B
MD5d6aef0b19d7d8dc2eda464cf358007b7
SHA1c271fa23eee2c534cc862f7575df47f660c94d27
SHA25670965d19e9afccec497ac21e98bfea9be46cf5df938982b3d19e6295aab3bb1d
SHA512c547f50069f9f97dd9877bdb529f4ed49f9761d5cab1ff703e5185a6071e7591b98237834c6bd386b68b9c6504b76bdc581bf17a6fcef94e74b1483d47cf764a
-
Filesize
696B
MD573dd42e0ba8cff47f0542d7d8aa40f90
SHA1ffbb1b56415be5abcf4613aed3136768f2edbc38
SHA256c73b4e554a4ae515ae3aa320a19d752e3d848d00ed0cd8f084081ed530b8fc3d
SHA512efd0075f9e70dd557271bdbcd782a083ae2cde8cd5674bf7f8cf63064847951adfcbaa9c9cff91c57d19c7308d0b7bf4754bfbe8fce6ec0e41d920bde7f5a67e
-
Filesize
696B
MD55ba8c208c5700f7f25c2e24e00d50ac8
SHA19838a0ab093ed94bc85a80b1feee14b68e4df8d1
SHA256213371c33e19f6f9e28f089e3206fe50c39b190548b0500f7ba8aff869a68cd6
SHA512065e45ebe4197cdf7e13b799928dfb29e17d4a1741e3e103000b147288b34f16300b72874ec85aefa2c04cc939df115a9fb383d5c95982c1371e75605d1a9b17
-
Filesize
696B
MD503f68343f5906993640e0b9e3f9c7964
SHA1699e9c3fda1aa89e7a47ac8b77b41178c99cc8e2
SHA256dd2d5bf380874e81adc5e05b667047dcf1b6c8a8953068fb177053e20c35f727
SHA51276de9e035c0ad6ee3237006749fd28ee93a6fcd09700e265aaea432f7d2292aac87f0799221559caacd6dd58ff72af17d67627aace77bd2a36a802bbdc88b99c
-
Filesize
696B
MD5ab52ce62f84a24d48d9cebec5331b1c6
SHA16fcb810a46e83020e55af419752f5583f9dcb9ba
SHA256908bec6021a78b90a02c6123db4ac62b590ea738e97fa35aac7c4dce624f3244
SHA5128823f3f60863692a8fd2be8610670b06077ea7c948b7c46f9a1ab712276b27e48c19d0a394e7f51c0fbdf753f989af4cac5dab078e4f04ee5ee6a50427368cd2
-
Filesize
696B
MD58cb32754e88999ece2a392d94875313e
SHA1da0ef4e297872b82db206ebdc4cafefeed2a4e3d
SHA2563dc5ae697f3f5a3ffe053412e05a646883c49be29b179039ceadf5f71a595f9d
SHA512a331a2472d0ef04f4d6a9b41a147020a688c96977feec8d61878f31382af8c27b8e990dc404137475d48f0155d600cc0d6ebe0a5d1cbb60b1fecf364301ebaa7
-
Filesize
696B
MD5f080eefd41c0fca1c404d5133fb5c957
SHA1bef3f9c014eca7cf4dc001f3d85befd3681d4bcc
SHA256758f74e1aa31de598fbf37f70ffd76f936c0b5dd2227b17c0d8e9ac4506f3aaf
SHA512e2066e4082f51d4064bfd68eff48c97c481bbb524bb0fa2da0b5ae25bda730811d2933480a72d91a8e5c10ac794f0e793fb8323892332eb9b7c43890ee25c4d7
-
Filesize
696B
MD5f9d25791d9949ef33ed0c208f3d11851
SHA11cdf525209a1d7ade65168011e4de530de7bdc5a
SHA256d3592a18c2a195dba2db76e25fb1516b2a9ef5297e9d72716e232d3540bc4481
SHA512efb6f3882b9c75aa5193cf1bfeeb430b0a963681bf5367f535e3eb9c4e7c796c0aa1d0e3df9803c635ba6d863dc129a9ab30c954c6d4af27803036859d3d3113
-
Filesize
1.1MB
MD55361b8e4eb93dc0d7d605b595e79137b
SHA10964025fe5129c55951ed11544e74a5f1ae8d02c
SHA256f269f0cecfa3dc2f38582c2cc868a07efb70c4324ebde32d24d87d37b59043b7
SHA5124af48d7d12eca94fabc6e72ccb9837edf43091d11578bf099a9013643d27227ff9d9e3123960a4d925fdad7bbe6de231db7a2148aa72ba7c022c79820f9a59ba
-
Filesize
1.1MB
MD5c57981586e5a3b213869119f815b366b
SHA14dd920c729fbde7f415d92c516f4c64eb5b86787
SHA25692cbf899bdad0b38727879e38849ed731eb90ff57327c1ec38946fa4a3610f47
SHA5125de5adac2b7d7ff3b2cc4735871bef959fa8b2b18751e8b16235c44c9bf7a881e31b16578854bfe6ebac7f435c8a6b9dff08e92c33f10bae302f78aaa2764ce6
-
Filesize
1.1MB
MD523ec5805d2b9251dc2626080a4b687ce
SHA1b5747af9546febe4c7cbfe8471d28a24415385d2
SHA256a4ff7f09ac2b0888abeaebca306027d17c60e6375096845c66f9096eb333c72f
SHA5122ad3c8f0ca260a8216b6f45d4dee58409a995ccc9fc8d2d397fc9b7e696877a0c92602a5dff61559e7119b2e62268e13d85375c58d3f33636a8e5b2f59fbdf2b
-
Filesize
1.1MB
MD5f7549d3e3f46bd1f4e0a7f51cde7cde1
SHA1e2006020f01a9155f5b4da8e01ea22867ece4212
SHA256b7c29649d8b29a687ebc4340a56309632514a3bebc1e0b668fcec5c45d3f4610
SHA51245627828d7c1d04f79f0b07b00b5783d8096d2479f9bfd3e6f58ffb04202360e39b8c827dcede0cb0bb8146a671049fdcfd977b2944f6f2ef09083ae876debcf
-
Filesize
1.1MB
MD5d3a30e4181dd92f24a9e7d828bb6de9c
SHA1d3d9214af15664b72f2004b4371598899d8c7af2
SHA2566636fd2aa7ef707d422e6a8431e2869a2445a7d549d5b84071cec5423c6ab36a
SHA512a083a6d51691e0629ee35f936502f9d024574bc6e63da7102605d10efc67a65651b802152094148c480acb6580ad8507d6e67e4d8ebb2cef1837a83dafb0df1a
-
Filesize
1.1MB
MD5eece9044d086d98826927bd2ce0d32b3
SHA1b1dfd25150a646c53fa3275a249616632115d0a0
SHA256ad99fd093c4eb7cd48f46738eed9a759877f9c48a4b5397b25bbf3c95a0e16c2
SHA512ca08dc31003919df87884aceb388a00418a06d7a03c8a7746178a50bd69e0ed128f13316664eccab8184bbef74f41bba5d8f8d893fce8d030a52bc03f2d1df5c