Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 11:35
Static task
static1
Behavioral task
behavioral1
Sample
7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe
Resource
win10v20210410
General
-
Target
7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe
-
Size
1.5MB
-
MD5
b4f71adf9ec04a2b87e7588d8af2ba9e
-
SHA1
316b8b6e5a80eb8d2e061a80527ff7be6731c25e
-
SHA256
7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1
-
SHA512
36b1259f6769582ae28a14ebf64ac7c8133f5513f8595892a3eb3de8d71b12966967e67f82ea0a301bc91f9f912d79862905048853e22b26c070aaf9368908d2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
vbc.exepid process 616 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdtr = "C:\\Users\\Admin\\AppData\\Roaming\\WinUpdtr\\7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe" 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exedescription pid process target process PID 4048 set thread context of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 616 vbc.exe Token: SeSecurityPrivilege 616 vbc.exe Token: SeTakeOwnershipPrivilege 616 vbc.exe Token: SeLoadDriverPrivilege 616 vbc.exe Token: SeSystemProfilePrivilege 616 vbc.exe Token: SeSystemtimePrivilege 616 vbc.exe Token: SeProfSingleProcessPrivilege 616 vbc.exe Token: SeIncBasePriorityPrivilege 616 vbc.exe Token: SeCreatePagefilePrivilege 616 vbc.exe Token: SeBackupPrivilege 616 vbc.exe Token: SeRestorePrivilege 616 vbc.exe Token: SeShutdownPrivilege 616 vbc.exe Token: SeDebugPrivilege 616 vbc.exe Token: SeSystemEnvironmentPrivilege 616 vbc.exe Token: SeChangeNotifyPrivilege 616 vbc.exe Token: SeRemoteShutdownPrivilege 616 vbc.exe Token: SeUndockPrivilege 616 vbc.exe Token: SeManageVolumePrivilege 616 vbc.exe Token: SeImpersonatePrivilege 616 vbc.exe Token: SeCreateGlobalPrivilege 616 vbc.exe Token: 33 616 vbc.exe Token: 34 616 vbc.exe Token: 35 616 vbc.exe Token: 36 616 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 616 vbc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exevbc.exedescription pid process target process PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 4048 wrote to memory of 616 4048 7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe vbc.exe PID 616 wrote to memory of 1432 616 vbc.exe iexplore.exe PID 616 wrote to memory of 1432 616 vbc.exe iexplore.exe PID 616 wrote to memory of 1432 616 vbc.exe iexplore.exe PID 616 wrote to memory of 1512 616 vbc.exe explorer.exe PID 616 wrote to memory of 1512 616 vbc.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe"C:\Users\Admin\AppData\Local\Temp\7a8916c13c6b816bc756134acdf71c4cb9f28e9dd0f6009783a84e2b26437af1.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵PID:1432
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵PID:1512
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
99d17ff97e92667bf238e5154e53c6a1
SHA1893d5e4fc27e23831dba69e39762fb494c7edc94
SHA256bb44568093a3b7299af075b09358bb4691abaa57c0496e8d97d289b05b58ad27
SHA51231c5a1425d3fd36a26dc85270a19d6d1a07a644466de4527798985b12aba1242a961e6df0990c6f0bbb7f21a4c4de31aa4baaaf18999894e7c6cb56f4689bddd
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeMD5
99d17ff97e92667bf238e5154e53c6a1
SHA1893d5e4fc27e23831dba69e39762fb494c7edc94
SHA256bb44568093a3b7299af075b09358bb4691abaa57c0496e8d97d289b05b58ad27
SHA51231c5a1425d3fd36a26dc85270a19d6d1a07a644466de4527798985b12aba1242a961e6df0990c6f0bbb7f21a4c4de31aa4baaaf18999894e7c6cb56f4689bddd
-
memory/616-115-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/616-116-0x000000000049F92C-mapping.dmp
-
memory/616-119-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/616-120-0x0000000000550000-0x00000000005FE000-memory.dmpFilesize
696KB
-
memory/4048-114-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB