fa5ac27700f443ba8bc0509f2ce8c1c0be408e3dbca55a07de27f7d1bcb5de16

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 18:53

Target

DRBFSJC.exe
Size

3.7MB
MD5

fcdb10a4ed519ba71aa3c715e0785977
SHA1

39634afc86ffe83e71e1a5a387d1b4314f33d2fe
SHA256

fa5ac27700f443ba8bc0509f2ce8c1c0be408e3dbca55a07de27f7d1bcb5de16
SHA512

12b66c3f4f1b8d11b223d61cb3429d11a9eda83a4a28484dcf0e3ce4f0f55ebf5ede2433fb114e4f20ddf2c749e9f2e7028210cefc04e3eee030849ba516b153
SSDEEP

49152:LqgtfkiCBPMP2vdBUEyVJwjQ1pxDG2OTINXRA1ked1iutOdj:2N5MeBUbVOjKpxDROcN4keHVwd

Score

7^/10

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

DRBFSJC.exe

pid process

900 DRBFSJC.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DRBFSJC.exe

description pid process

Token: SeDebugPrivilege 900 DRBFSJC.exe

pid	process
900	DRBFSJC.exe

description	pid	process
Token: SeDebugPrivilege	900	DRBFSJC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DRBFSJC.exe

description	pid	process	target process
PID 900 wrote to memory of 1384	900	DRBFSJC.exe	vbc.exe
PID 900 wrote to memory of 1384	900	DRBFSJC.exe	vbc.exe
PID 900 wrote to memory of 1384	900	DRBFSJC.exe	vbc.exe
PID 900 wrote to memory of 1384	900	DRBFSJC.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\DRBFSJC.exe
"C:\Users\Admin\AppData\Local\Temp\DRBFSJC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe"
  2⤵
  PID:1384

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/900-54-0x0000000000340000-0x00000000006F0000-memory.dmp

Filesize
3.7MB

Download
memory/900-55-0x0000000002250000-0x00000000022B6000-memory.dmp

Filesize
408KB

Download