0f9f2ed3669af8502dfad754d0dc2e7682fe7bc4d0044f7cc3ca61a0e1170d15

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 17KB
Sample201109-th3b611dys
SHA256 0f9f2ed3669af8502dfad754d0dc2e7682fe7bc4d0044f7cc3ca61a0e1170d15
MD5 0b660bffa6e0093bf7054a8d80071585
SHA1 6450139c6698b3cfb67cf9f06a0b3190c44442af
SHA512 09fb8bbe5d013fa01ba5cd50595a2d273411a71344ba3e9af7864dbad185c88844c128b023f85368c1718c05e9799f46d2af11dc0665c14c4c30dfd161537f48
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	file.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1420	1700	file.exe	29
PID 1700 wrote to memory of 1420	1700	file.exe	29
PID 1700 wrote to memory of 1420	1700	file.exe	29
PID 1420 wrote to memory of 292	1420	vbc.exe	31
PID 1420 wrote to memory of 292	1420	vbc.exe	31
PID 1420 wrote to memory of 292	1420	vbc.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lyzsof9x.cmdline"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9AF9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9AF8.tmp"
    3⤵
    PID:292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-0-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Download

memory/1700-1-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp