Analysis
-
max time kernel
116s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 09:19
Static task
static1
Behavioral task
behavioral1
Sample
e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe
-
Size
1.5MB
-
MD5
f548e99a9e0b219930e28696a0979619
-
SHA1
fc09b9c82ac761f28a04c2d4d3bdf07b000d6b47
-
SHA256
e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2
-
SHA512
bf875c949a83a1babd1f6c91fc707aac7e759cfa043f7289c96ff1ebdee30ea423277896cd2ebabfaf206d4a8e81a708aa93cdbe2d6255487582ff85d50aded7
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft@Service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe" e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exedescription pid process target process PID 1764 set thread context of 2164 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2528 2164 WerFault.exe vbc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exepid process 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exepid process 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exedescription pid process target process PID 1764 wrote to memory of 2164 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe vbc.exe PID 1764 wrote to memory of 2164 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe vbc.exe PID 1764 wrote to memory of 2164 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe vbc.exe PID 1764 wrote to memory of 2164 1764 e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe"C:\Users\Admin\AppData\Local\Temp\e0380fd96474eebdde85471abc553c688cef21db70120fb7352151ad58c954a2.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 883⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2164-116-0x000000000048F888-mapping.dmp