Analysis
-
max time kernel
87s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-02-2023 18:30
Behavioral task
behavioral1
Sample
2313.docx
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2313.docx
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
O.rtf
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
O.rtf
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
vbc.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
vbc.exe
Resource
win10v2004-20220812-en
General
-
Target
vbc.exe
-
Size
381KB
-
MD5
c42bd43f9c9d353cfc49d5b795ecd8a9
-
SHA1
f98c3be5642f443a07186e4958b255ad0fc128f6
-
SHA256
638e98a58de88b8add87b99d13aea148e1cd7b4035e9ca0e7b5596f2888fc983
-
SHA512
a1020c9c52802a0d1b76fafaab33952d2be67578292ed1aae1270ffe67561d2f88b5f1bc102a474c1fa1f0da304b8e1625b66f3e31cad06f6c91c9af33aec210
-
SSDEEP
6144:fC2+8+wt3bWVWAPApgXOWm6L6pMMKCvCMxIq5EENcNxMMDy0Q4Y3ShiF:f3ZpCtLFkvC6NMxMH0Q42H
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 1420 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 1 IoCs
Processes:
vbc.exedescription ioc process File opened for modification C:\Windows\resources\0409\pasta\Nedlggelsernes.ini vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsg981F.tmp\System.dllFilesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
memory/1420-136-0x0000000004990000-0x000000000889F000-memory.dmpFilesize
63.1MB
-
memory/1420-137-0x0000000004990000-0x000000000889F000-memory.dmpFilesize
63.1MB