Overview

overview

10

Static

static

2f27554c5f...b4.exe

windows7_x64

8

2f27554c5f...b4.exe

windows10_x64

10

Analysis

  • max time kernel
    32s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    08-09-2021 17:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2f27554c5fbeb881bfe32ea5475befb4.exe

  • Size

    5KB

  • MD5

    2f27554c5fbeb881bfe32ea5475befb4

  • SHA1

    48eceac335a3129cbf2bc50b9026ba3a7d4b58de

  • SHA256

    62adcba42e924882bbbc57aa1a7801e7000ba3366e055beeab5d935d9f7822fc

  • SHA512

    5bed056bd6dd68c45837418b461b2e88bbf70466400c55b7228275cd9552a6b8cdd446b3f469d8844a6ff9c796b9fc054b27819a77f067bba27f502038248e99

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f27554c5fbeb881bfe32ea5475befb4.exe
    "C:\Users\Admin\AppData\Local\Temp\2f27554c5fbeb881bfe32ea5475befb4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:772

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scripting

    1
    T1064

    Persistence

    Privilege Escalation

    Defense Evasion

    Scripting

    1
    T1064

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1104-60-0x0000000000DB0000-0x0000000000DB1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1104-62-0x0000000075551000-0x0000000075553000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1104-63-0x0000000004C30000-0x0000000004C31000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1104-64-0x0000000000D50000-0x0000000000DAF000-memory.dmp
      Filesize

      380KB

      Download
    • memory/1104-65-0x0000000000950000-0x0000000000951000-memory.dmp
      Filesize

      4KB

      Download