Malware Analysis Report

2025-01-18 12:18

Sample ID 241122-z4cpyayrh1
Target 62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe
SHA256 62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645
Tags
wshrat discovery persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645

Threat Level: Known bad

The file 62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe was found to be: Known bad.

Malicious Activity Summary

wshrat discovery persistence trojan

WSHRAT

Wshrat family

WSHRAT payload

Blocklisted process makes network request

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-22 21:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-22 21:15

Reported

2024-11-22 21:17

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe"

Signatures

WSHRAT

trojan wshrat

WSHRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Wshrat family

wshrat

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OPAFu.vbs C:\Windows\SysWOW64\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EkoHX.vbs C:\Windows\SysWOW64\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EkoHX.vbs C:\Windows\SysWOW64\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OPAFu.vbs C:\Windows\SysWOW64\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\74800197\WHS2.0.exe N/A
N/A N/A C:\74800197\wcnaumia.pif N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\EkoHX = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\EkoHX.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EkoHX = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\EkoHX.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\OPAFu = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\OPAFu.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OPAFu = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\OPAFu.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3036 set thread context of 2792 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\74800197\WHS2.0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\74800197\wcnaumia.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\WHS2.0.exe
PID 2644 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\WHS2.0.exe
PID 2644 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\WHS2.0.exe
PID 2644 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\WHS2.0.exe
PID 2644 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\wcnaumia.pif
PID 2644 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\wcnaumia.pif
PID 2644 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\wcnaumia.pif
PID 2644 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\wcnaumia.pif
PID 2564 wrote to memory of 1664 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 2564 wrote to memory of 1664 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 2564 wrote to memory of 1664 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 2564 wrote to memory of 1664 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 3036 wrote to memory of 2792 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3036 wrote to memory of 2792 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3036 wrote to memory of 2792 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3036 wrote to memory of 2792 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3036 wrote to memory of 2792 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3036 wrote to memory of 2792 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3036 wrote to memory of 2792 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3036 wrote to memory of 2792 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3036 wrote to memory of 2792 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2792 wrote to memory of 752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe
PID 2792 wrote to memory of 752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe
PID 2792 wrote to memory of 752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe
PID 2792 wrote to memory of 752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe

"C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe"

C:\74800197\WHS2.0.exe

"C:\74800197\WHS2.0.exe" Community portal – Bulletin board,

C:\74800197\wcnaumia.pif

"C:\74800197\wcnaumia.pif" fhmoqoe.prw

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\EkoHX.vbs

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\OPAFu.vbs

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 concideritdone.duckdns.org udp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 208.95.112.1:80 ip-api.com tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp

Files

\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

\74800197\wcnaumia.pif

MD5 1d7071dd5cda216508b235c0e2318b05
SHA1 0b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256 788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA512 65965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118

memory/2564-85-0x00000000006E0000-0x0000000000720000-memory.dmp

C:\Users\Admin\AppData\Roaming\EkoHX.vbs

MD5 952b1cbd78885f81760a77dc3b453fd3
SHA1 4af75b46620b063fc23652c3ecaa3b4081074572
SHA256 fe3f15e4a3d59457c16fb955e38be8df4bfe3a0978a2b09c85705f14bb6d751d
SHA512 1d6f2f6d91f88725b9515b2877348616dee3d96b862014f6c6b54f41b18835483cdf5b6294e99e0fdff17d80d79b27ac70638cab6376b15526b87b592313b837

C:\74800197\vijppg.txt

MD5 808bdb5b8f93f34c6d64bb48283776ec
SHA1 e3f096b0ea493885ba3e1058594c2d48d4ea89c9
SHA256 799a62dc96ba037ccec9ca7a417a4c5428454a3f52c7b4444f728d79b5f06fd7
SHA512 97582524e55fbb90185dd4e5c8eb6ea5e1a57aa5354278878786881593ef2bd85f3fba8ef6a94d89b8f9dc14c07ee85553e58fa00dd64adfe73d954f3a4af0ff

C:\74800197\envmhh.cos

MD5 80eee5b692798640be0b6d0ca2f8768c
SHA1 c39d4b5b048194ef1acdecc8b7cab27e63bc0402
SHA256 9b6c1dad4b42a308e4fade72da97589161c7cc37c5d926353f216e1903ec9780
SHA512 c587cc27b96fa66a1188947b85f9f27ea61e502e21456411536f48e533377e80301a4fe82eba451d82c1d12b9c5368336d166542d44f12b990a73d10382612d8

memory/2792-96-0x0000000000310000-0x0000000000A17000-memory.dmp

memory/2792-98-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2792-99-0x0000000000310000-0x0000000000A17000-memory.dmp

memory/2792-101-0x0000000000310000-0x0000000000A17000-memory.dmp

memory/2792-100-0x0000000000310000-0x0000000000A17000-memory.dmp

memory/2792-103-0x0000000000310000-0x000000000039A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\json[1].json

MD5 c085beeb6f771b90fed94c1d940f97f6
SHA1 44a994d9175d6abaa9a3b5718e242fa659aed66a
SHA256 ff5681f440a7a4b019a4a59f43ad414393321d1eb6dc3874cea0a84e73a83c51
SHA512 9d000581b287cd3d5464c33c260008090369a4f5f380b7cfa72eb0fc3221ce0e07df0387f6d3d6b38253c215250ac873dec0f52c501e3d6312f0a5437723a76a

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-22 21:15

Reported

2024-11-22 21:17

Platform

win10v2004-20241007-en

Max time kernel

109s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe"

Signatures

WSHRAT

trojan wshrat

WSHRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Wshrat family

wshrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\74800197\WHS2.0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EkoHX.vbs C:\Windows\SysWOW64\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OPAFu.vbs C:\Windows\SysWOW64\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OPAFu.vbs C:\Windows\SysWOW64\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EkoHX.vbs C:\Windows\SysWOW64\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\74800197\WHS2.0.exe N/A
N/A N/A C:\74800197\wcnaumia.pif N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EkoHX = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\EkoHX.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EkoHX = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\EkoHX.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OPAFu = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\OPAFu.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OPAFu = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\OPAFu.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3556 set thread context of 1672 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\74800197\WHS2.0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\74800197\wcnaumia.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4224 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\WHS2.0.exe
PID 4224 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\WHS2.0.exe
PID 4224 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\WHS2.0.exe
PID 4224 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\wcnaumia.pif
PID 4224 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\wcnaumia.pif
PID 4224 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe C:\74800197\wcnaumia.pif
PID 8 wrote to memory of 2004 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 8 wrote to memory of 2004 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 8 wrote to memory of 2004 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 3556 wrote to memory of 1672 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3556 wrote to memory of 1672 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3556 wrote to memory of 1672 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3556 wrote to memory of 1672 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3556 wrote to memory of 1672 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1672 wrote to memory of 2512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe
PID 1672 wrote to memory of 2512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe
PID 1672 wrote to memory of 2512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe

"C:\Users\Admin\AppData\Local\Temp\62a67c42c309613f6bdd8dca730e8a03d2ad7067d89c57b5a980da1e37e33645.exe"

C:\74800197\WHS2.0.exe

"C:\74800197\WHS2.0.exe" Community portal – Bulletin board,

C:\74800197\wcnaumia.pif

"C:\74800197\wcnaumia.pif" fhmoqoe.prw

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\EkoHX.vbs

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\OPAFu.vbs

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 concideritdone.duckdns.org udp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 162.203.100.95.in-addr.arpa udp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 8.8.8.8:53 74.209.201.84.in-addr.arpa udp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp
US 156.96.44.168:5001 concideritdone.duckdns.org tcp

Files

C:\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

memory/8-64-0x0000000073412000-0x0000000073413000-memory.dmp

C:\74800197\wcnaumia.pif

MD5 1d7071dd5cda216508b235c0e2318b05
SHA1 0b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256 788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA512 65965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118

memory/8-69-0x0000000073410000-0x00000000739C1000-memory.dmp

memory/8-70-0x0000000073410000-0x00000000739C1000-memory.dmp

memory/8-74-0x0000000073410000-0x00000000739C1000-memory.dmp

C:\Users\Admin\AppData\Roaming\EkoHX.vbs

MD5 952b1cbd78885f81760a77dc3b453fd3
SHA1 4af75b46620b063fc23652c3ecaa3b4081074572
SHA256 fe3f15e4a3d59457c16fb955e38be8df4bfe3a0978a2b09c85705f14bb6d751d
SHA512 1d6f2f6d91f88725b9515b2877348616dee3d96b862014f6c6b54f41b18835483cdf5b6294e99e0fdff17d80d79b27ac70638cab6376b15526b87b592313b837

C:\74800197\vijppg.txt

MD5 808bdb5b8f93f34c6d64bb48283776ec
SHA1 e3f096b0ea493885ba3e1058594c2d48d4ea89c9
SHA256 799a62dc96ba037ccec9ca7a417a4c5428454a3f52c7b4444f728d79b5f06fd7
SHA512 97582524e55fbb90185dd4e5c8eb6ea5e1a57aa5354278878786881593ef2bd85f3fba8ef6a94d89b8f9dc14c07ee85553e58fa00dd64adfe73d954f3a4af0ff

C:\74800197\envmhh.cos

MD5 80eee5b692798640be0b6d0ca2f8768c
SHA1 c39d4b5b048194ef1acdecc8b7cab27e63bc0402
SHA256 9b6c1dad4b42a308e4fade72da97589161c7cc37c5d926353f216e1903ec9780
SHA512 c587cc27b96fa66a1188947b85f9f27ea61e502e21456411536f48e533377e80301a4fe82eba451d82c1d12b9c5368336d166542d44f12b990a73d10382612d8

memory/1672-85-0x0000000000800000-0x0000000000EDA000-memory.dmp

memory/1672-86-0x0000000000800000-0x000000000088A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\json[1].json

MD5 c085beeb6f771b90fed94c1d940f97f6
SHA1 44a994d9175d6abaa9a3b5718e242fa659aed66a
SHA256 ff5681f440a7a4b019a4a59f43ad414393321d1eb6dc3874cea0a84e73a83c51
SHA512 9d000581b287cd3d5464c33c260008090369a4f5f380b7cfa72eb0fc3221ce0e07df0387f6d3d6b38253c215250ac873dec0f52c501e3d6312f0a5437723a76a