Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 20:29
Static task
static1
Behavioral task
behavioral1
Sample
ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe
Resource
win10v2004-20240802-en
General
-
Target
ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe
-
Size
1.1MB
-
MD5
8b7749318d787392fa03aef03729187c
-
SHA1
1d92d7d5df694e1a9c1cdeb014d409d71cd2adf2
-
SHA256
ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8
-
SHA512
dccdf4f52be724590b62cc0e28569c4b1f40cea76930da62c3d103a2d5036807984e7ac8010461bf5aed4b7f1876d07e3b835e43f15e7fa69184de57b5bb8c55
-
SSDEEP
24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qf:acallSllG4ZM7QzMo
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2596 svchcst.exe -
Executes dropped EXE 23 IoCs
pid Process 2596 svchcst.exe 2884 svchcst.exe 2476 svchcst.exe 2084 svchcst.exe 1500 svchcst.exe 1584 svchcst.exe 2508 svchcst.exe 872 svchcst.exe 2644 svchcst.exe 1820 svchcst.exe 2680 svchcst.exe 2008 svchcst.exe 1784 svchcst.exe 2104 svchcst.exe 2508 svchcst.exe 2876 svchcst.exe 860 svchcst.exe 2480 svchcst.exe 1140 svchcst.exe 296 svchcst.exe 1012 svchcst.exe 1648 svchcst.exe 2212 svchcst.exe -
Loads dropped DLL 33 IoCs
pid Process 2800 WScript.exe 2800 WScript.exe 1516 WScript.exe 904 WScript.exe 904 WScript.exe 2012 WScript.exe 2012 WScript.exe 1576 WScript.exe 1664 WScript.exe 2264 WScript.exe 2632 WScript.exe 2948 WScript.exe 2948 WScript.exe 2456 WScript.exe 1016 WScript.exe 2408 WScript.exe 2408 WScript.exe 2384 WScript.exe 2384 WScript.exe 2436 WScript.exe 2436 WScript.exe 2584 WScript.exe 2584 WScript.exe 2500 WScript.exe 2500 WScript.exe 2852 WScript.exe 2852 WScript.exe 2448 WScript.exe 2448 WScript.exe 1924 WScript.exe 1924 WScript.exe 1556 WScript.exe 1556 WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2264 ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe 2596 svchcst.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2264 ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe -
Suspicious use of SetWindowsHookEx 48 IoCs
pid Process 2264 ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe 2264 ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe 2596 svchcst.exe 2596 svchcst.exe 2884 svchcst.exe 2884 svchcst.exe 2476 svchcst.exe 2476 svchcst.exe 2084 svchcst.exe 2084 svchcst.exe 1500 svchcst.exe 1500 svchcst.exe 1584 svchcst.exe 1584 svchcst.exe 2508 svchcst.exe 2508 svchcst.exe 872 svchcst.exe 872 svchcst.exe 2644 svchcst.exe 2644 svchcst.exe 1820 svchcst.exe 1820 svchcst.exe 2680 svchcst.exe 2680 svchcst.exe 2008 svchcst.exe 2008 svchcst.exe 1784 svchcst.exe 1784 svchcst.exe 2104 svchcst.exe 2104 svchcst.exe 2508 svchcst.exe 2508 svchcst.exe 2876 svchcst.exe 2876 svchcst.exe 860 svchcst.exe 860 svchcst.exe 2480 svchcst.exe 2480 svchcst.exe 1140 svchcst.exe 1140 svchcst.exe 296 svchcst.exe 296 svchcst.exe 1012 svchcst.exe 1012 svchcst.exe 1648 svchcst.exe 1648 svchcst.exe 2212 svchcst.exe 2212 svchcst.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2800 2264 ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe 30 PID 2264 wrote to memory of 2800 2264 ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe 30 PID 2264 wrote to memory of 2800 2264 ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe 30 PID 2264 wrote to memory of 2800 2264 ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe 30 PID 2800 wrote to memory of 2596 2800 WScript.exe 32 PID 2800 wrote to memory of 2596 2800 WScript.exe 32 PID 2800 wrote to memory of 2596 2800 WScript.exe 32 PID 2800 wrote to memory of 2596 2800 WScript.exe 32 PID 2596 wrote to memory of 1516 2596 svchcst.exe 33 PID 2596 wrote to memory of 1516 2596 svchcst.exe 33 PID 2596 wrote to memory of 1516 2596 svchcst.exe 33 PID 2596 wrote to memory of 1516 2596 svchcst.exe 33 PID 1516 wrote to memory of 2884 1516 WScript.exe 34 PID 1516 wrote to memory of 2884 1516 WScript.exe 34 PID 1516 wrote to memory of 2884 1516 WScript.exe 34 PID 1516 wrote to memory of 2884 1516 WScript.exe 34 PID 2884 wrote to memory of 904 2884 svchcst.exe 35 PID 2884 wrote to memory of 904 2884 svchcst.exe 35 PID 2884 wrote to memory of 904 2884 svchcst.exe 35 PID 2884 wrote to memory of 904 2884 svchcst.exe 35 PID 904 wrote to memory of 2476 904 WScript.exe 36 PID 904 wrote to memory of 2476 904 WScript.exe 36 PID 904 wrote to memory of 2476 904 WScript.exe 36 PID 904 wrote to memory of 2476 904 WScript.exe 36 PID 2476 wrote to memory of 2924 2476 svchcst.exe 37 PID 2476 wrote to memory of 2924 2476 svchcst.exe 37 PID 2476 wrote to memory of 2924 2476 svchcst.exe 37 PID 2476 wrote to memory of 2924 2476 svchcst.exe 37 PID 904 wrote to memory of 2084 904 WScript.exe 38 PID 904 wrote to memory of 2084 904 WScript.exe 38 PID 904 wrote to memory of 2084 904 WScript.exe 38 PID 904 wrote to memory of 2084 904 WScript.exe 38 PID 2084 wrote to memory of 2012 2084 svchcst.exe 39 PID 2084 wrote to memory of 2012 2084 svchcst.exe 39 PID 2084 wrote to memory of 2012 2084 svchcst.exe 39 PID 2084 wrote to memory of 2012 2084 svchcst.exe 39 PID 2012 wrote to memory of 1500 2012 WScript.exe 40 PID 2012 wrote to memory of 1500 2012 WScript.exe 40 PID 2012 wrote to memory of 1500 2012 WScript.exe 40 PID 2012 wrote to memory of 1500 2012 WScript.exe 40 PID 1500 wrote to memory of 1732 1500 svchcst.exe 41 PID 1500 wrote to memory of 1732 1500 svchcst.exe 41 PID 1500 wrote to memory of 1732 1500 svchcst.exe 41 PID 1500 wrote to memory of 1732 1500 svchcst.exe 41 PID 2012 wrote to memory of 1584 2012 WScript.exe 42 PID 2012 wrote to memory of 1584 2012 WScript.exe 42 PID 2012 wrote to memory of 1584 2012 WScript.exe 42 PID 2012 wrote to memory of 1584 2012 WScript.exe 42 PID 1584 wrote to memory of 1576 1584 svchcst.exe 43 PID 1584 wrote to memory of 1576 1584 svchcst.exe 43 PID 1584 wrote to memory of 1576 1584 svchcst.exe 43 PID 1584 wrote to memory of 1576 1584 svchcst.exe 43 PID 1576 wrote to memory of 2508 1576 WScript.exe 44 PID 1576 wrote to memory of 2508 1576 WScript.exe 44 PID 1576 wrote to memory of 2508 1576 WScript.exe 44 PID 1576 wrote to memory of 2508 1576 WScript.exe 44 PID 2508 wrote to memory of 1664 2508 svchcst.exe 45 PID 2508 wrote to memory of 1664 2508 svchcst.exe 45 PID 2508 wrote to memory of 1664 2508 svchcst.exe 45 PID 2508 wrote to memory of 1664 2508 svchcst.exe 45 PID 1664 wrote to memory of 872 1664 WScript.exe 46 PID 1664 wrote to memory of 872 1664 WScript.exe 46 PID 1664 wrote to memory of 872 1664 WScript.exe 46 PID 1664 wrote to memory of 872 1664 WScript.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe"C:\Users\Admin\AppData\Local\Temp\ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- System Location Discovery: System Language Discovery
PID:2924
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"10⤵
- System Location Discovery: System Language Discovery
PID:1732
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"10⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:872 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"14⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2644 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"16⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1820 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"18⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2680 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"20⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1784 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"22⤵
- System Location Discovery: System Language Discovery
PID:796
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2008 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"20⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1016 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2104 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2508 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"24⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2876 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"26⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:860 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"28⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2584 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2480 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"30⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1140 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2852 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:296 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"34⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1012 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"36⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"38⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1556 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2212 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"40⤵
- System Location Discovery: System Language Discovery
PID:2428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD567b9b3e2ded7086f393ebbc36c5e7bca
SHA1e6299d0450b9a92a18cc23b5704a2b475652c790
SHA25644063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
SHA512826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
-
Filesize
753B
MD53ef2902a6cd218032fd5616372462e9f
SHA1bd1e4005f827ed6e1868fdeb65ee345e997819fc
SHA256f8b4d383d559a61239ab0ba0a822c2a2ba6f45b22f1d1437f5d23e7b617af5f4
SHA51221bc2d1ba8e9749ff07211ec2ad81b3bf8ae7af42d6aa3ae0bb07c5a7711b34f80b8eea1d49b7e7946cd4fb75b3e234664dfaf1e4a1dd6f2edab6591ca284563
-
Filesize
696B
MD56491ffe6ef75436d9e660280f5c7fa8f
SHA1aa563dfffa849153924e8a50f5b562663d1549b5
SHA25661926578340a542bb64c6abd62437790f27fe9f3c91f6e7bc3268fe318333382
SHA5127caf0a3528181a867f6a7d1e705531db6eb12a82faa881fde4693b6d1f57be05e589c9276fc6364204494cd9c65f355a35d1dafb0d02582346057b5c4b8c2193
-
Filesize
696B
MD5f2d2f31794455ef80ea8a41b0b218045
SHA1926c4e45922f43c6afc2cb31d96b5b35d4db3cae
SHA256698e3bc7681704e68728030dcceb12377aae02f71e91a5fd15c12b686ba00141
SHA51236cc2c9bd29c6bd97c2bd7eef7b9bffc512ebabf43d089a2866a66efc4f4f3f7d92b2d0719ae61ad07c38b89b1c0a4b59df57f84beef76c88bd376125048d714
-
Filesize
696B
MD5840853c0aa5a4d702a8110a0cb763b4b
SHA158d028e09818c3fd2a9d521c26772cf4d1a9072a
SHA2564438df44bf53668a332407b1c60d745bd1293a3f1acab9953b1d77e5131d2728
SHA512f2b044e4710dadb03164bc78519207bd8d39d2cf9d4568fc11c38271eabc3e57410083b1cf29e40b1f6119ffa33ed4784ef652f112e50b554c2983755a606b6a
-
Filesize
696B
MD5f988db0382571319f9b0af53097c2376
SHA1fd83936b61f5d4256a899610d5c13c5a9b24e625
SHA2568557443470cff4b30c533603a8e73dd9b9c55af2bae1ed0a7ce86d860fe4953c
SHA5128f0df896cf7432ac5248f1149a79cc721e40e80dc1ced770f830725c00e64bb96944bbdd375aa25587e0574dba32375934cbf99bf99f33267296c1e605ac8703
-
Filesize
696B
MD5f3159db8bd483868144429c5909d280a
SHA1a3698b1ebb0e43a564357bb77c3462539a114f87
SHA256f31b8921a342ba1eecff8852bd1904a17e94e544a1975106b9b5533155ed044c
SHA512328e166bbd706c7e6848c246909d96779ee2efcdf7bdb0ff47eed24e0267dcca005bb41651b60393ffafbb7b7467d94b22454e8c4be57108ffeb6238e88db916
-
Filesize
696B
MD5c94fda6716d92036e02a0e70b433735f
SHA1eb4e57b1461e03a201dbfd20dd308ca88694e55d
SHA256ca8d32856a5ad76e2bf41249ee83a498c238f51d9d3addbd5ca456ee6a6108ba
SHA512bf4b3613a4d6d2854f7750a73f84579a3022c2aaae770c392c3d4b273cbb2b493028f8109856ba66ee4636bcfac53b61b7f9b689002858a040b62b47d097d24f
-
Filesize
696B
MD5ae75c3a96c26ddc15e3c678434b18374
SHA17abb4cd173f5c8565c891bc5305922439e880fed
SHA2561b84f073d7c021672b1951a420b183f570b94f4d7c14c86698b22bbd353bf965
SHA512e817ab91d4d73840a290ff2e999a5136328b315afa16ec831b6ddabea08cf07d8dd61b332cbeded13bde712e7c87538228ff8d163c0f659da84134f04e5a3b7e
-
Filesize
696B
MD56e11da1c8a05db963ff0dda7c43866e0
SHA1e1343d4a94a629047631b0c53a0501eace14d2a9
SHA2562605d23ba5b4a9fc117704a99d9351dfffc81f22681becb9aa59d72a64a6a8f6
SHA51274be18fd41e091762e317fd4565c13d36832ca7d8fbcb60631c8e818c25f447db2ed4b3bc20e4a97da5efeb3ab66dbe815f34776b3db338a1e7d41abc57c99ac
-
Filesize
696B
MD573dd42e0ba8cff47f0542d7d8aa40f90
SHA1ffbb1b56415be5abcf4613aed3136768f2edbc38
SHA256c73b4e554a4ae515ae3aa320a19d752e3d848d00ed0cd8f084081ed530b8fc3d
SHA512efd0075f9e70dd557271bdbcd782a083ae2cde8cd5674bf7f8cf63064847951adfcbaa9c9cff91c57d19c7308d0b7bf4754bfbe8fce6ec0e41d920bde7f5a67e
-
Filesize
696B
MD599c82369839776d3d954a85361e76565
SHA1fe01d71a20a80f468e5fa4df991eacca97e650a1
SHA256ecfe1904a389f25b460a8eec64349498fde06733fa12cd5ae8e0c49a9699154f
SHA5125deb6fd1534298cbc80f4653e60b9dcaba6cfd4af1f3b1e5369929472ab4f8cba7d50d3f63d7154170b5ea84f40f7511f1839f2e89340c6942fede255c93b69f
-
Filesize
696B
MD575b8f60cfe6895a93f2d8f1b5568af94
SHA1b80485bc82864b4e1bf0bcc44579eaa01776b1fb
SHA2566ff47f7681e8f497470bd11b2cfd8156c5d8f1b01f48bfd89037cc4bfe0f34cc
SHA512089e237c5309d36058e036f69d78deb4144749e91b3a8a8383f817af051a3452acfdf42227cc721517e93428cfd5d48b42e9750e9548762609e81917a4de29c2
-
Filesize
1.1MB
MD54e2c24462e3e49dbe6ba884911b2e79f
SHA142a6fca7f5606bfd523449eca459c2cb3d3ea216
SHA256719d2dc0b52b3435b2974a01174535329dec4f7a130a1127a6d6d181d682ec52
SHA512689dc0a33fc815b84c6e08e930cf0dd7f1a19c6f600ff4d545de7a0a6620530c8054c58a800002993c8fe508a72d483ad008b995bfdb9d1a594f9a7d3d38900f