7911f1a67c2580f0390dd9eea76d879801c77cb2e114a307e28cb3d31b23f340

Analysis

max time kernel
142s
max time network
132s
platform
windows7_x64
resource
win7v20201028
submitted
28/12/2020, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
order-1812896543124646423.exe
Size 4.5MB
Sample201228-ys7knqangs
SHA256 7911f1a67c2580f0390dd9eea76d879801c77cb2e114a307e28cb3d31b23f340
MD5 fc8dc8736cbc013863b77c8f9963c8d6
SHA1 86f046bab6a953fe8323e347b1a0f45730870589
SHA512 b691feee667980728150316262dba76c87e27ef2a5cea40321986482ac4a61788a61bd7029443bad7c5a1bda8316963a7c5e69a7c9d9eebfa2b1ea224eb9b569
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1496	vbc.exe
1496	vbc.exe
1496	vbc.exe
1496	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1824 set thread context of 1496	1824	order-1812896543124646423.exe	34

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1824	order-1812896543124646423.exe
1824	order-1812896543124646423.exe
1824	order-1812896543124646423.exe
1824	order-1812896543124646423.exe
1824	order-1812896543124646423.exe
1824	order-1812896543124646423.exe
1824	order-1812896543124646423.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	order-1812896543124646423.exe
Token: SeDebugPrivilege	1496	vbc.exe
Token: SeShutdownPrivilege	1496	vbc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1496	vbc.exe
1496	vbc.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1768	1824	order-1812896543124646423.exe	29
PID 1824 wrote to memory of 1768	1824	order-1812896543124646423.exe	29
PID 1824 wrote to memory of 1768	1824	order-1812896543124646423.exe	29
PID 1824 wrote to memory of 1768	1824	order-1812896543124646423.exe	29
PID 1824 wrote to memory of 1284	1824	order-1812896543124646423.exe	31
PID 1824 wrote to memory of 1284	1824	order-1812896543124646423.exe	31
PID 1824 wrote to memory of 1284	1824	order-1812896543124646423.exe	31
PID 1824 wrote to memory of 1284	1824	order-1812896543124646423.exe	31
PID 1824 wrote to memory of 604	1824	order-1812896543124646423.exe	32
PID 1824 wrote to memory of 604	1824	order-1812896543124646423.exe	32
PID 1824 wrote to memory of 604	1824	order-1812896543124646423.exe	32
PID 1824 wrote to memory of 604	1824	order-1812896543124646423.exe	32
PID 1824 wrote to memory of 316	1824	order-1812896543124646423.exe	33
PID 1824 wrote to memory of 316	1824	order-1812896543124646423.exe	33
PID 1824 wrote to memory of 316	1824	order-1812896543124646423.exe	33
PID 1824 wrote to memory of 316	1824	order-1812896543124646423.exe	33
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34
PID 1824 wrote to memory of 1496	1824	order-1812896543124646423.exe	34

C:\Users\Admin\AppData\Local\Temp\order-1812896543124646423.exe
"C:\Users\Admin\AppData\Local\Temp\order-1812896543124646423.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TNJvRpAbRb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5AFC.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-12-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/1496-10-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/1496-13-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1496-14-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1496-15-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1496-16-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1824-5-0x00000000007C0000-0x00000000007C6000-memory.dmp

Download

memory/1824-6-0x0000000007430000-0x0000000007820000-memory.dmp

Download

memory/1824-7-0x0000000007820000-0x0000000007BF0000-memory.dmp

Download

memory/1824-3-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/1824-2-0x0000000074570000-0x0000000074C5E000-memory.dmp

Download