Analysis
-
max time kernel
128s -
max time network
134s -
platform
windows10_x64 -
resource
win10 -
submitted
29-06-2020 07:12
Static task
static1
Behavioral task
behavioral1
Sample
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe
-
Size
1.5MB
-
MD5
edb8b19beede18b21ec7ebc847271fd1
-
SHA1
8ec1c660059fc6a0571782fe17ed30787055b278
-
SHA256
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398
-
SHA512
88197dc5f5480378481f0fc8165c051dc87148176fcae89a9367eaf004506d82755596f89c0d6fecbea5005301514caf507c1145edd9b657192258d10804e5c3
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft@Software = "C:\\Users\\Admin\\AppData\\Local\\Temp\\78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe" 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exedescription pid process target process PID 3068 set thread context of 3860 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3932 3860 WerFault.exe vbc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exepid process 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exepid process 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exedescription pid process target process PID 3068 wrote to memory of 3860 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 3068 wrote to memory of 3860 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 3068 wrote to memory of 3860 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 3068 wrote to memory of 3860 3068 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe"C:\Users\Admin\AppData\Local\Temp\78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 883⤵
- Program crash