55886c6ca1f919306f9fb917482d230f8485b394ec997e8c94de7430453ca27f

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/02/2023, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
misshas_document_contract_promoutins.scr.exe
Size 1.5MB
Sample230214-ml5lsacf76
SHA256 55886c6ca1f919306f9fb917482d230f8485b394ec997e8c94de7430453ca27f
MD5 2e9d8fd1ceab10a6db6fff22bffdc105
SHA1 ae5e69ef5d777809ca93176a9a64fef525db7407
SHA512 046f7fa6cf9e35ddd4b3855e53f4b9837a88f44d6203ba40a1190efa9d6bf310623cc8f21450fb82c00e650115919672b25d0fb36f97810a33bb8c8ec2670315
SSDEEP 24576:fnUverXwQUCHazvUGKVmklx9m+ZtUqUOCUbUUZUeUwUNUqUGUpUVUFUYU5UYU/Uu:fUverX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 860	1636	misshas_document_contract_promoutins.scr.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
860	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	vbc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 860	1636	misshas_document_contract_promoutins.scr.exe	27
PID 1636 wrote to memory of 860	1636	misshas_document_contract_promoutins.scr.exe	27
PID 1636 wrote to memory of 860	1636	misshas_document_contract_promoutins.scr.exe	27
PID 1636 wrote to memory of 860	1636	misshas_document_contract_promoutins.scr.exe	27
PID 1636 wrote to memory of 860	1636	misshas_document_contract_promoutins.scr.exe	27
PID 1636 wrote to memory of 860	1636	misshas_document_contract_promoutins.scr.exe	27
PID 1636 wrote to memory of 860	1636	misshas_document_contract_promoutins.scr.exe	27
PID 1636 wrote to memory of 860	1636	misshas_document_contract_promoutins.scr.exe	27
PID 1636 wrote to memory of 860	1636	misshas_document_contract_promoutins.scr.exe	27

C:\Users\Admin\AppData\Local\Temp\misshas_document_contract_promoutins.scr.exe
"C:\Users\Admin\AppData\Local\Temp\misshas_document_contract_promoutins.scr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-55-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/860-56-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/860-58-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/860-60-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/860-61-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/860-64-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/860-66-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/860-67-0x0000000075071000-0x0000000075073000-memory.dmp

Download

memory/1636-54-0x0000000000930000-0x00000000009AA000-memory.dmp

Download