8114e5e30720952dbf0515a5f3801c7c0ef51844758e25b100b768a29c01155a

Analysis

Target

vbc.exe
Size

335KB
MD5

dcbed5a043d3eca73e3451f66718882f
SHA1

48d598c8d8cdef964d51c20fcf90421abb4da85a
SHA256

8114e5e30720952dbf0515a5f3801c7c0ef51844758e25b100b768a29c01155a
SHA512

cc82b9c701dacd25be9038be9c506b36a75d495cb96143e77d050562f21a4c83876826203bce0766ab34369569efafe9f7415cab8ae68582a3219f6e624e80c9

Score

7^/10

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2888 1636 WerFault.exe vbc.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2888 WerFault.exe
Token: SeBackupPrivilege 2888 WerFault.exe
Token: SeDebugPrivilege 2888 WerFault.exe

pid	pid_target	process	target process
2888	1636	WerFault.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
PID:1636

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2888-0-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/2888-1-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download