Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-12-2021 09:58
Static task
static1
Behavioral task
behavioral1
Sample
tmp/vbc.exe
Resource
win7-en-20211208
General
-
Target
tmp/vbc.exe
-
Size
1.4MB
-
MD5
3668f9be040098859e662ba94616cc51
-
SHA1
3b3ec4ac86c462747a2190c33ca2a4588fcc9310
-
SHA256
b190c0b66428b594f7507ae98fcc45e1907cb9cdf618919002791241ae94280f
-
SHA512
54fa8de69114af4fc8ccfa5ef11a82587d3b74b5fa80e6e8d1683e5ce997db5d6ffc1b133ebcf97c226c2aad928696198392faaf184486685f0aa2a048a43dd3
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
vbc.exepowershell.exepid process 944 vbc.exe 944 vbc.exe 944 vbc.exe 944 vbc.exe 944 vbc.exe 944 vbc.exe 944 vbc.exe 944 vbc.exe 944 vbc.exe 944 vbc.exe 428 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exepowershell.exedescription pid process Token: SeDebugPrivilege 944 vbc.exe Token: SeDebugPrivilege 428 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
vbc.exedescription pid process target process PID 944 wrote to memory of 428 944 vbc.exe powershell.exe PID 944 wrote to memory of 428 944 vbc.exe powershell.exe PID 944 wrote to memory of 428 944 vbc.exe powershell.exe PID 944 wrote to memory of 428 944 vbc.exe powershell.exe PID 944 wrote to memory of 1060 944 vbc.exe schtasks.exe PID 944 wrote to memory of 1060 944 vbc.exe schtasks.exe PID 944 wrote to memory of 1060 944 vbc.exe schtasks.exe PID 944 wrote to memory of 1060 944 vbc.exe schtasks.exe PID 944 wrote to memory of 1304 944 vbc.exe vbc.exe PID 944 wrote to memory of 1304 944 vbc.exe vbc.exe PID 944 wrote to memory of 1304 944 vbc.exe vbc.exe PID 944 wrote to memory of 1304 944 vbc.exe vbc.exe PID 944 wrote to memory of 620 944 vbc.exe vbc.exe PID 944 wrote to memory of 620 944 vbc.exe vbc.exe PID 944 wrote to memory of 620 944 vbc.exe vbc.exe PID 944 wrote to memory of 620 944 vbc.exe vbc.exe PID 944 wrote to memory of 808 944 vbc.exe vbc.exe PID 944 wrote to memory of 808 944 vbc.exe vbc.exe PID 944 wrote to memory of 808 944 vbc.exe vbc.exe PID 944 wrote to memory of 808 944 vbc.exe vbc.exe PID 944 wrote to memory of 1868 944 vbc.exe vbc.exe PID 944 wrote to memory of 1868 944 vbc.exe vbc.exe PID 944 wrote to memory of 1868 944 vbc.exe vbc.exe PID 944 wrote to memory of 1868 944 vbc.exe vbc.exe PID 944 wrote to memory of 1852 944 vbc.exe vbc.exe PID 944 wrote to memory of 1852 944 vbc.exe vbc.exe PID 944 wrote to memory of 1852 944 vbc.exe vbc.exe PID 944 wrote to memory of 1852 944 vbc.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SOEtXbQzHDdq.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SOEtXbQzHDdq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7B09.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\tmp\vbc.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7B09.tmpMD5
c90feb1871ab38e07093604dfa364f2d
SHA11b5672489fa0fdb20c75da7f5410b7f091b2a04e
SHA2565f0b50fcfc5b11474353ea795d5a5a765cf94292f8aba6dd7f289a1e36ebc777
SHA512977753da1733c54a3435fcd488b8e0fb91eff53b9ba33adabf8feb6411eb3c3d82db2ed12ec3fa337ee5c83241c1ba787e0a1a96977755066205cb723425055a
-
memory/428-57-0x0000000000000000-mapping.dmp
-
memory/428-61-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/428-62-0x0000000000651000-0x0000000000652000-memory.dmpFilesize
4KB
-
memory/428-63-0x0000000000652000-0x0000000000654000-memory.dmpFilesize
8KB
-
memory/944-54-0x0000000076151000-0x0000000076153000-memory.dmpFilesize
8KB
-
memory/944-55-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/944-56-0x0000000000661000-0x0000000000662000-memory.dmpFilesize
4KB
-
memory/1060-58-0x0000000000000000-mapping.dmp