e018d5f9ce45e81a96459fa0c717df76b2d765f24a9a472ad2cb8d13b523f562

General

Target

vbc.exe
Size

281KB
MD5

a9dcc61f31601e771050463c4d41cdb0
SHA1

c26979f1842c9f2460fc9e0f9285266b0d175b49
SHA256

e018d5f9ce45e81a96459fa0c717df76b2d765f24a9a472ad2cb8d13b523f562
SHA512

7c592e8f6042bea65cbd5261b0150c761b4b724e61e983dc32c2e3be62b48d1acac53986db097fe4c79a597d928f8e17ffcb639b6fc45623229719136548e6a6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

vbc.exe

pid process

2032 vbc.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1504 1432 WerFault.exe vbc.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1504 WerFault.exe
1504 WerFault.exe
1504 WerFault.exe
1504 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1504 WerFault.exe

pid	process
2032	vbc.exe

pid	pid_target	process	target process
1504	1432	WerFault.exe	vbc.exe

pid	process
1504	WerFault.exe
1504	WerFault.exe
1504	WerFault.exe
1504	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1504	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

vbc.exevbc.exe

description	pid	process	target process
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 2032 wrote to memory of 1432	2032	vbc.exe	vbc.exe
PID 1432 wrote to memory of 1504	1432	vbc.exe	WerFault.exe
PID 1432 wrote to memory of 1504	1432	vbc.exe	WerFault.exe
PID 1432 wrote to memory of 1504	1432	vbc.exe	WerFault.exe
PID 1432 wrote to memory of 1504	1432	vbc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 148
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1324

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsg9685.tmp\hmrrcvb.dll
MD5
8f1756b3fece1d28c57cabff0fda9ab1

SHA1
1d81cb4c36da87bee907656f9e77b1e5b159b3f0

SHA256
65efe70f4feae095ea7a9497007f2307f49572a8878ac5d304b66dd3ac0ddfb0

SHA512
79aeae44e83647486682a7e3bf387522feeddc9252766109c3a0837758f3a88ddc77bb84de84f76742abad61f8a5517ba7b71e9e2dadad274e621c44d050a040

Download Submit
memory/1324-64-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Filesize
8KB

Download
memory/1432-55-0x0000000000000000-mapping.dmp

Download
memory/1432-56-0x00000000001C0000-0x00000000001DB000-memory.dmp

Filesize
108KB

Download
memory/1504-61-0x0000000000000000-mapping.dmp

Download
memory/1504-63-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2032-53-0x00000000759B1000-0x00000000759B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing