87a7b708cf5f194568ce728a77c5778078720d6ff6346ea269f0a5427398ad60

Analysis

max time kernel
55s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vbc.exe
Size

448KB
MD5

0157a88e62b7651bf765bd4fbf73264c
SHA1

fba492f92871cbf674563578d3e91ccb4a412c71
SHA256

87a7b708cf5f194568ce728a77c5778078720d6ff6346ea269f0a5427398ad60
SHA512

821184beaa4e49af6e05583992ea98800a1494fcfe4c0d534dbb048dc2960208545432bb1c59c7f5cb69573bb2e7cb33d90904415c6563873ead802c4e4279c7
SSDEEP

12288:w1bVCfn7om/rE7KdHJaKZODGZ5N1Um4ObM1Mjc:w1ofn7X/9dJaSODGZ5f5hoajc

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1660 1656 WerFault.exe vbc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc.exe

pid process

1656 vbc.exe
1656 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 1656 vbc.exe

pid	pid_target	process	target process
1660	1656	WerFault.exe	vbc.exe

pid	process
1656	vbc.exe
1656	vbc.exe

description	pid	process
Token: SeDebugPrivilege	1656	vbc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

vbc.exe

description	pid	process	target process
PID 1656 wrote to memory of 1660	1656	vbc.exe	WerFault.exe
PID 1656 wrote to memory of 1660	1656	vbc.exe	WerFault.exe
PID 1656 wrote to memory of 1660	1656	vbc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1656 -s 592
2⤵
- Program crash
PID:1660

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-54-0x0000000000910000-0x0000000000984000-memory.dmp

Filesize
464KB

Download
memory/1660-55-0x0000000000000000-mapping.dmp

Download