d91d04a052c74e24823eeeeec79d14cf3a5bcdd50ca4867d0cffd5a6188085d7

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
03/05/2022, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vbc.exe
Size 991KB
Sample220503-rtj29shcb2
SHA256 d91d04a052c74e24823eeeeec79d14cf3a5bcdd50ca4867d0cffd5a6188085d7
MD5 8640d5837c0fdbdc8a4b6966da2848ca
SHA1 0d619c30d819564ec1f32cac2dfabd3c772f4802
SHA512 545ae80bfbfc2b2ca7bcb84f805091e10ddc1374102ba6bc7b9988cd8358fbaeafb06fed1d8e5eaf538825532e40ec146001008bc71b28d20af2771c5ccf43a7
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1792	556	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	556	vbc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 1792	556	vbc.exe	28
PID 556 wrote to memory of 1792	556	vbc.exe	28
PID 556 wrote to memory of 1792	556	vbc.exe	28
PID 556 wrote to memory of 1792	556	vbc.exe	28

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 544
  2⤵
  - Program crash
  PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-54-0x0000000000300000-0x00000000003FE000-memory.dmp

Download