1bbdd6534336280436213b88cf3075db3754a027cbf39351dd81f923ed0ed137

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220414-en
submitted
29/06/2022, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vbc.exe
Size 18KB
Sample220629-tb7fyscdf9
SHA256 1bbdd6534336280436213b88cf3075db3754a027cbf39351dd81f923ed0ed137
MD5 a31e69aaa031369d0d125d3ecd7c7255
SHA1 817e5630d17740ffde1a5b35b3a8e7f15987b05b
SHA512 793f124840bb182387404e32fe0d76eb0a4256985d99e9821e3d065cc65a909a7b3f748410266128355e36888f04fe3613225adc54e59c54a231f1d5405722db
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-54-0x00000000008D0000-0x00000000008DA000-memory.dmp

Download

memory/1320-55-0x0000000075CD1000-0x0000000075CD3000-memory.dmp