56ac909a9052c965c797e92ce321b03b2855c2cc1df3c73c0f7b524bb86b5ef6

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vbc.exe
Size

381KB
MD5

c42bd43f9c9d353cfc49d5b795ecd8a9
SHA1

f98c3be5642f443a07186e4958b255ad0fc128f6
SHA256

638e98a58de88b8add87b99d13aea148e1cd7b4035e9ca0e7b5596f2888fc983
SHA512

a1020c9c52802a0d1b76fafaab33952d2be67578292ed1aae1270ffe67561d2f88b5f1bc102a474c1fa1f0da304b8e1625b66f3e31cad06f6c91c9af33aec210
SSDEEP

6144:fC2+8+wt3bWVWAPApgXOWm6L6pMMKCvCMxIq5EENcNxMMDy0Q4Y3ShiF:f3ZpCtLFkvC6NMxMH0Q42H

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

vbc.exe

pid process

1108 vbc.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 1 IoCs

Processes:

vbc.exe

description ioc process

File opened for modification C:\Windows\resources\0409\pasta\Nedlggelsernes.ini vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1108	vbc.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\pasta\Nedlggelsernes.ini	vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1108

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsi2667.tmp\System.dll
Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
memory/1108-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1108-56-0x0000000003690000-0x00000000037EC000-memory.dmp

Filesize
1.4MB

Download