Analysis

  • max time kernel
    14s
  • max time network
    76s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-07-2021 08:25

General

  • Target

    vbc.exe

  • Size

    410KB

  • MD5

    63a91aa1f367950eaef7b38117483628

  • SHA1

    c70db448a527d8493c69f635d0ac981d0855fd2e

  • SHA256

    0fc450ebd441e9037f509104c318a1c38cdbf7d6dd2fea77b1011d6fa956ca52

  • SHA512

    a5305e285371a533cb57aefe8ec3eaa6a5f5f345d9452f0462bdbea07590df2ce4c82ad0a63868381a38ffd916408d8ff055bc9e505afc249924e54294bda906

Score
7/10

Malware Config

Signatures

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vbc.exe
    "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Users\Admin\AppData\Local\Temp\vbc.exe
      "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
      2⤵
        PID:1588
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 876
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3784

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Defense Evasion

    Scripting

    1
    T1064

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/656-115-0x0000000000590000-0x0000000000592000-memory.dmp
      Filesize

      8KB

    • memory/1588-114-0x000000000040188B-mapping.dmp
    • memory/1588-116-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/1588-117-0x0000000002210000-0x0000000002247000-memory.dmp
      Filesize

      220KB

    • memory/1588-118-0x0000000004890000-0x0000000004891000-memory.dmp
      Filesize

      4KB