af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9

Analysis

max time kernel
141s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe
Size

636KB
MD5

ecb0c16d3841ac90be6c7088a4318796
SHA1

628afc91a2b250a8ec003c29e72522ceb2271172
SHA256

af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9
SHA512

58cb7005206dcad9afab7a0a0c5065cbff13ffe8d227c13ab0e3d485aa7366453339196419a546680dbb365b76636c0f1c1fd0002600e306d12cc57312d20696
SSDEEP

12288:woZB7TepbosaV5jTuQzA6VPSrAtQwbafJOMIXlpZVv7GCckZWu+KfsX36j96g:woZo7i5uQz9VPEfwbuJOMI19vqChZW3e

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3048	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1632 set thread context of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	3048	vbc.exe
Token: SeCreateTokenPrivilege	3048	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	3048	vbc.exe
Token: SeLockMemoryPrivilege	3048	vbc.exe
Token: SeIncreaseQuotaPrivilege	3048	vbc.exe
Token: SeMachineAccountPrivilege	3048	vbc.exe
Token: SeTcbPrivilege	3048	vbc.exe
Token: SeSecurityPrivilege	3048	vbc.exe
Token: SeTakeOwnershipPrivilege	3048	vbc.exe
Token: SeLoadDriverPrivilege	3048	vbc.exe
Token: SeSystemProfilePrivilege	3048	vbc.exe
Token: SeSystemtimePrivilege	3048	vbc.exe
Token: SeProfSingleProcessPrivilege	3048	vbc.exe
Token: SeIncBasePriorityPrivilege	3048	vbc.exe
Token: SeCreatePagefilePrivilege	3048	vbc.exe
Token: SeCreatePermanentPrivilege	3048	vbc.exe
Token: SeBackupPrivilege	3048	vbc.exe
Token: SeRestorePrivilege	3048	vbc.exe
Token: SeShutdownPrivilege	3048	vbc.exe
Token: SeDebugPrivilege	3048	vbc.exe
Token: SeAuditPrivilege	3048	vbc.exe
Token: SeSystemEnvironmentPrivilege	3048	vbc.exe
Token: SeChangeNotifyPrivilege	3048	vbc.exe
Token: SeRemoteShutdownPrivilege	3048	vbc.exe
Token: SeUndockPrivilege	3048	vbc.exe
Token: SeSyncAgentPrivilege	3048	vbc.exe
Token: SeEnableDelegationPrivilege	3048	vbc.exe
Token: SeManageVolumePrivilege	3048	vbc.exe
Token: SeImpersonatePrivilege	3048	vbc.exe
Token: SeCreateGlobalPrivilege	3048	vbc.exe
Token: 31	3048	vbc.exe
Token: 32	3048	vbc.exe
Token: 33	3048	vbc.exe
Token: 34	3048	vbc.exe
Token: 35	3048	vbc.exe
Token: SeDebugPrivilege	3048	vbc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3048	vbc.exe
3048	vbc.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80
PID 1632 wrote to memory of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80
PID 1632 wrote to memory of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80
PID 1632 wrote to memory of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80
PID 1632 wrote to memory of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80
PID 1632 wrote to memory of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80
PID 1632 wrote to memory of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80
PID 1632 wrote to memory of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80
PID 1632 wrote to memory of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80
PID 1632 wrote to memory of 3048	1632	af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe	80

C:\Users\Admin\AppData\Local\Temp\af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe
"C:\Users\Admin\AppData\Local\Temp\af03c3debd39ad7009d9c1f3f7c804479a5b3f45db7834da301185be946c36c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\vbc.exe
  C:\Users\Admin\AppData\Local\Temp\vbc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vbc.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/1632-132-0x0000000075510000-0x0000000075AC1000-memory.dmp

Filesize
5.7MB

Download
memory/1632-139-0x0000000075510000-0x0000000075AC1000-memory.dmp

Filesize
5.7MB

Download
memory/3048-134-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3048-140-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3048-143-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download