3ebc8e64441c213c5a56e694c415d80348031417274de9908b6212680bca4cd4

Analysis

Target
SecuriteInfo.com.Trojan.VbCrypt.150.4858.23907.exe
Size 4.7MB
Sample200828-e47l3zcg8x
SHA256 3ebc8e64441c213c5a56e694c415d80348031417274de9908b6212680bca4cd4
MD5 9d5280c7ffeaf6dcd81eea002c076dc4
SHA1 cdea34646d74fe5cc226aad71899193a30b07be0
SHA512 9cbea26b945eb8c4cdc55afacec0f8e9116d261f9bfd272a20d897cf9b84d90c4286e974e831a0086eef9b6bc30e54e791d743adf2622ef136fbd75e5a41bead
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2404	SecuriteInfo.com.Trojan.VbCrypt.150.4858.23907.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = cf423969f37cd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	496	svchost.exe
Token: SeCreatePagefilePrivilege	496	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2404	3952	SecuriteInfo.com.Trojan.VbCrypt.150.4858.23907.exe	72
PID 3952 wrote to memory of 2404	3952	SecuriteInfo.com.Trojan.VbCrypt.150.4858.23907.exe	72
PID 3952 wrote to memory of 2404	3952	SecuriteInfo.com.Trojan.VbCrypt.150.4858.23907.exe	72

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.VbCrypt.150.4858.23907.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.VbCrypt.150.4858.23907.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\is-UNNA1.tmp\SecuriteInfo.com.Trojan.VbCrypt.150.4858.23907.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UNNA1.tmp\SecuriteInfo.com.Trojan.VbCrypt.150.4858.23907.tmp" /SL5="$201CC,4624797,62464,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.VbCrypt.150.4858.23907.exe"
  2⤵
  - Executes dropped EXE
  PID:2404