Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows7_x64 -
resource
win7 -
submitted
30-06-2020 06:48
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vbc.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
vbc.exe
-
Size
444KB
-
MD5
c66f665b6e12b556e6c90b52af988edc
-
SHA1
58060b2ab7c2441aeb29a034c48fc190c9789281
-
SHA256
ac8087b133a1022287bb8aad082e1fd0b669509289a5ef5f2e17714de7acfb5b
-
SHA512
7a18c04db5e2a35477429568b86890b56e8e9a9c46f11283069a07305759411769727edb1f0c392920fc8d546659957b75cfb78fc26f1cf53d6550c048a80ae4
Score
8/10
Malware Config
Signatures
-
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
colorcpl.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GDTHEFWHG8GX = "C:\\Program Files (x86)\\Xjrktnj2h\\taskhostonuxdx50.exe" colorcpl.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
vbc.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 900 wrote to memory of 1608 900 vbc.exe AddInProcess32.exe PID 900 wrote to memory of 1608 900 vbc.exe AddInProcess32.exe PID 900 wrote to memory of 1608 900 vbc.exe AddInProcess32.exe PID 900 wrote to memory of 1608 900 vbc.exe AddInProcess32.exe PID 900 wrote to memory of 1608 900 vbc.exe AddInProcess32.exe PID 900 wrote to memory of 1608 900 vbc.exe AddInProcess32.exe PID 900 wrote to memory of 1608 900 vbc.exe AddInProcess32.exe PID 1336 wrote to memory of 760 1336 Explorer.EXE colorcpl.exe PID 1336 wrote to memory of 760 1336 Explorer.EXE colorcpl.exe PID 1336 wrote to memory of 760 1336 Explorer.EXE colorcpl.exe PID 1336 wrote to memory of 760 1336 Explorer.EXE colorcpl.exe PID 760 wrote to memory of 1116 760 colorcpl.exe cmd.exe PID 760 wrote to memory of 1116 760 colorcpl.exe cmd.exe PID 760 wrote to memory of 1116 760 colorcpl.exe cmd.exe PID 760 wrote to memory of 1116 760 colorcpl.exe cmd.exe PID 760 wrote to memory of 1920 760 colorcpl.exe Firefox.exe PID 760 wrote to memory of 1920 760 colorcpl.exe Firefox.exe PID 760 wrote to memory of 1920 760 colorcpl.exe Firefox.exe PID 760 wrote to memory of 1920 760 colorcpl.exe Firefox.exe PID 760 wrote to memory of 1920 760 colorcpl.exe Firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exeAddInProcess32.execolorcpl.exedescription pid process Token: SeDebugPrivilege 900 vbc.exe Token: SeDebugPrivilege 1608 AddInProcess32.exe Token: SeDebugPrivilege 760 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
vbc.exeAddInProcess32.execolorcpl.exepid process 900 vbc.exe 900 vbc.exe 900 vbc.exe 1608 AddInProcess32.exe 1608 AddInProcess32.exe 1608 AddInProcess32.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 900 vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
AddInProcess32.exepid process 1608 AddInProcess32.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
AddInProcess32.execolorcpl.exepid process 1608 AddInProcess32.exe 1608 AddInProcess32.exe 1608 AddInProcess32.exe 1608 AddInProcess32.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe 760 colorcpl.exe -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exeAddInProcess32.execolorcpl.exedescription pid process target process PID 900 set thread context of 1608 900 vbc.exe AddInProcess32.exe PID 1608 set thread context of 1336 1608 AddInProcess32.exe Explorer.EXE PID 1608 set thread context of 1336 1608 AddInProcess32.exe Explorer.EXE PID 760 set thread context of 1336 760 colorcpl.exe Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE 1336 Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 1 IoCs
Processes:
colorcpl.exedescription ioc process File opened for modification C:\Program Files (x86)\Xjrktnj2h\taskhostonuxdx50.exe colorcpl.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
-
C:\Users\Admin\AppData\Roaming\8P866TE7\8P8logim.jpeg
-
C:\Users\Admin\AppData\Roaming\8P866TE7\8P8logrf.ini
-
C:\Users\Admin\AppData\Roaming\8P866TE7\8P8logri.ini
-
C:\Users\Admin\AppData\Roaming\8P866TE7\8P8logrv.ini
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
-
memory/760-8-0x0000000000000000-mapping.dmp
-
memory/760-9-0x0000000000530000-0x0000000000548000-memory.dmpFilesize
96KB
-
memory/760-12-0x0000000003020000-0x00000000030DE000-memory.dmpFilesize
760KB
-
memory/760-13-0x00000000769D0000-0x00000000769DC000-memory.dmpFilesize
48KB
-
memory/760-14-0x0000000076740000-0x000000007685D000-memory.dmpFilesize
1.1MB
-
memory/760-15-0x00000000032A0000-0x000000000336D000-memory.dmpFilesize
820KB
-
memory/900-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1116-11-0x0000000000000000-mapping.dmp
-
memory/1336-7-0x0000000006AF0000-0x0000000006C43000-memory.dmpFilesize
1.3MB
-
memory/1608-5-0x000000000041E320-mapping.dmp
-
memory/1608-4-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1920-17-0x000000013F570000-0x000000013F603000-memory.dmpFilesize
588KB
-
memory/1920-16-0x0000000000000000-mapping.dmp