990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe
Size

304KB
MD5

09d48a33e0e06906e5d2491e9ade278f
SHA1

dacc469daf0fb9f12c9f2f1e37a82df76be45fb8
SHA256

990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48
SHA512

b13d85779d805f77c4f71844db9525b65ed865b91b0bb11ba94ea52cb2f76578eda2df6245af8ece8a9c6c559cca096fb7a581b54f757ceabb087ed48549c01d
SSDEEP

6144:ePFLTSg57PY2EaRp7zyCftZejPNeqeeEvLwdSH5nABQh:ePFL+a7PdzRp7zyCTesVjCB

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\taskhosts.exe = "C:\\Users\\Admin\\AppData\\Roaming\\taskhosts.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\windows live = "C:\\Users\\Admin\\AppData\\Roaming\\taskhosts.exe"	vbc.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FFEBCE9D-CE42-DEEB-BDDF-9BB529D82D2D}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\taskhosts.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FFEBCE9D-CE42-DEEB-BDDF-9BB529D82D2D}	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components\{FFEBCE9D-CE42-DEEB-BDDF-9BB529D82D2D}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\taskhosts.exe"	vbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FFEBCE9D-CE42-DEEB-BDDF-9BB529D82D2D}	vbc.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/676-63-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/676-66-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/676-65-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/676-69-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/676-71-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/676-84-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/676-86-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windows live = "C:\\Users\\Admin\\AppData\\Roaming\\taskhosts.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows live = "C:\\Users\\Admin\\AppData\\Roaming\\taskhosts.exe"	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 676	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	30

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	vbc.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1040	reg.exe
304	reg.exe
1016	reg.exe
1152	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	676	vbc.exe
Token: SeCreateTokenPrivilege	676	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	676	vbc.exe
Token: SeLockMemoryPrivilege	676	vbc.exe
Token: SeIncreaseQuotaPrivilege	676	vbc.exe
Token: SeMachineAccountPrivilege	676	vbc.exe
Token: SeTcbPrivilege	676	vbc.exe
Token: SeSecurityPrivilege	676	vbc.exe
Token: SeTakeOwnershipPrivilege	676	vbc.exe
Token: SeLoadDriverPrivilege	676	vbc.exe
Token: SeSystemProfilePrivilege	676	vbc.exe
Token: SeSystemtimePrivilege	676	vbc.exe
Token: SeProfSingleProcessPrivilege	676	vbc.exe
Token: SeIncBasePriorityPrivilege	676	vbc.exe
Token: SeCreatePagefilePrivilege	676	vbc.exe
Token: SeCreatePermanentPrivilege	676	vbc.exe
Token: SeBackupPrivilege	676	vbc.exe
Token: SeRestorePrivilege	676	vbc.exe
Token: SeShutdownPrivilege	676	vbc.exe
Token: SeDebugPrivilege	676	vbc.exe
Token: SeAuditPrivilege	676	vbc.exe
Token: SeSystemEnvironmentPrivilege	676	vbc.exe
Token: SeChangeNotifyPrivilege	676	vbc.exe
Token: SeRemoteShutdownPrivilege	676	vbc.exe
Token: SeUndockPrivilege	676	vbc.exe
Token: SeSyncAgentPrivilege	676	vbc.exe
Token: SeEnableDelegationPrivilege	676	vbc.exe
Token: SeManageVolumePrivilege	676	vbc.exe
Token: SeImpersonatePrivilege	676	vbc.exe
Token: SeCreateGlobalPrivilege	676	vbc.exe
Token: 31	676	vbc.exe
Token: 32	676	vbc.exe
Token: 33	676	vbc.exe
Token: 34	676	vbc.exe
Token: 35	676	vbc.exe
Token: SeDebugPrivilege	676	vbc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
676	vbc.exe
676	vbc.exe
676	vbc.exe
676	vbc.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 900	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	27
PID 2024 wrote to memory of 900	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	27
PID 2024 wrote to memory of 900	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	27
PID 2024 wrote to memory of 900	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	27
PID 900 wrote to memory of 544	900	csc.exe	29
PID 900 wrote to memory of 544	900	csc.exe	29
PID 900 wrote to memory of 544	900	csc.exe	29
PID 900 wrote to memory of 544	900	csc.exe	29
PID 2024 wrote to memory of 676	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	30
PID 2024 wrote to memory of 676	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	30
PID 2024 wrote to memory of 676	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	30
PID 2024 wrote to memory of 676	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	30
PID 2024 wrote to memory of 676	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	30
PID 2024 wrote to memory of 676	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	30
PID 2024 wrote to memory of 676	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	30
PID 2024 wrote to memory of 676	2024	990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe	30
PID 676 wrote to memory of 1496	676	vbc.exe	31
PID 676 wrote to memory of 1496	676	vbc.exe	31
PID 676 wrote to memory of 1496	676	vbc.exe	31
PID 676 wrote to memory of 1496	676	vbc.exe	31
PID 676 wrote to memory of 1316	676	vbc.exe	36
PID 676 wrote to memory of 1316	676	vbc.exe	36
PID 676 wrote to memory of 1316	676	vbc.exe	36
PID 676 wrote to memory of 1316	676	vbc.exe	36
PID 676 wrote to memory of 572	676	vbc.exe	32
PID 676 wrote to memory of 572	676	vbc.exe	32
PID 676 wrote to memory of 572	676	vbc.exe	32
PID 676 wrote to memory of 572	676	vbc.exe	32
PID 676 wrote to memory of 1196	676	vbc.exe	33
PID 676 wrote to memory of 1196	676	vbc.exe	33
PID 676 wrote to memory of 1196	676	vbc.exe	33
PID 676 wrote to memory of 1196	676	vbc.exe	33
PID 1496 wrote to memory of 1152	1496	cmd.exe	38
PID 1496 wrote to memory of 1152	1496	cmd.exe	38
PID 1496 wrote to memory of 1152	1496	cmd.exe	38
PID 1496 wrote to memory of 1152	1496	cmd.exe	38
PID 1316 wrote to memory of 1040	1316	cmd.exe	40
PID 1316 wrote to memory of 1040	1316	cmd.exe	40
PID 1316 wrote to memory of 1040	1316	cmd.exe	40
PID 1316 wrote to memory of 1040	1316	cmd.exe	40
PID 572 wrote to memory of 304	572	cmd.exe	41
PID 572 wrote to memory of 304	572	cmd.exe	41
PID 572 wrote to memory of 304	572	cmd.exe	41
PID 572 wrote to memory of 304	572	cmd.exe	41
PID 1196 wrote to memory of 1016	1196	cmd.exe	42
PID 1196 wrote to memory of 1016	1196	cmd.exe	42
PID 1196 wrote to memory of 1016	1196	cmd.exe	42
PID 1196 wrote to memory of 1016	1196	cmd.exe	42

C:\Users\Admin\AppData\Local\Temp\990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe
"C:\Users\Admin\AppData\Local\Temp\990101a369f71b8ae608012a85420bfee85c556d4664a02515566f3d1fbb4e48.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\83aorzpk.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES11AF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC11AE.tmp"
    3⤵
    PID:544
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1152
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\taskhosts.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\taskhosts.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\taskhosts.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\taskhosts.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\83aorzpk.dll

Filesize
9KB

MD5
9e3bd976b63f3a7803c648a53c133c13

SHA1
0dfdc75b97b9e4f34736bdb44d683d44a297d52c

SHA256
10510ec45d5da02929f951fd0c55424800f1e3a9e11ec1f60d84f28d359e3314

SHA512
80f524c5222f389b07b7dfb95d693a170f97d6d10250c64dbbaaa3cdc9343f765de0357d769308a5023cb75059925262046727c78d8297afea4fbd3c67922134

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES11AF.tmp

Filesize
1KB

MD5
e794d378aa6c9811bc925992b5959b83

SHA1
5a08ffa11d167e511438d4ac63121d1695c77069

SHA256
13457aad9ca4dac339c7ce608ee84bae0d896a34c70d6f198a7289b9a6eedf3e

SHA512
382123a360d239786a736acf2f6f963372badbae93ff203ffcff03d0993a1a86edae00ae3afc65be5dd31f660ce3fb1fd09170edd29446d2621e9d9525718b4e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\83aorzpk.0.cs

Filesize
7KB

MD5
c79c02b8be614ba0ad11b9a2deac9067

SHA1
5338181abf8d8436df240ec8bfe8699ed40eac83

SHA256
aeb41fe4117e42c32d7c61fe9caa02f2ec937418a3ffb6ee64b5a8309e0d7b78

SHA512
4b0efe655b237185454a41c79c1b5cd9b8e80cfa36f7abb8a5d63629f400bb73d58f196584ec5421a8b2e6608b9c00d44514ada9651bcf19aea8ba4cce5b4a4e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\83aorzpk.cmdline

Filesize
187B

MD5
cb1a9edd96ed89033e154392bd8eedb1

SHA1
2b6d1b1f4fb8ebaf1d2a5ae4f9a375dfa9fe0c47

SHA256
b17b3c38e3b78c35ecaeb9ea3e5bfbae41a45fa375d34c6beb679dbed9cf618e

SHA512
65679e8dd7113b53aa64180c334592c148d2900f39749b7dfc7b3adfd03ac3d1e1a5ec7ad159eb0b40cb16bd31b9569c4726ea1245c5037abf4ff1007aab3f10

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC11AE.tmp

Filesize
652B

MD5
53bc42b3a07af9068dcc1a6a517612aa

SHA1
e89666479cb9512ddc903cd6255b48c3c5211096

SHA256
73dbdf31f46bf3342a4a00e44f37d39ce7addbace7b32f54dda7540a53e80bf9

SHA512
fb8693e109aaaafd0e14fc2474522c72ab3563d32e34e655ae6717fea21d8bc2b750ac9a6ce014e7f7dd8242b98fef37c6c3f387de9869f7b9fb61fcb70f5e62

Download Submit
memory/676-62-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/676-66-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/676-65-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/676-86-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/676-69-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/676-84-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/676-71-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/676-63-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2024-70-0x0000000074E10000-0x00000000753BB000-memory.dmp

Filesize
5.7MB

Download
memory/2024-85-0x0000000074E10000-0x00000000753BB000-memory.dmp

Filesize
5.7MB

Download
memory/2024-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads