Resubmissions
06-01-2025 13:01
250106-p9jekaxkcx 1013-10-2024 23:16
241013-289lkssepc 1014-03-2023 17:05
230314-vl5ksagf73 714-03-2023 16:59
230314-vhej7agf56 7Analysis
-
max time kernel
15s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-03-2023 16:59
Static task
static1
Behavioral task
behavioral1
Sample
thisIsScary.exe
Resource
win7-20230220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
thisIsScary.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
thisIsScary.exe
-
Size
746.2MB
-
MD5
f359144193a123071150ae6d7c998a2e
-
SHA1
f521e43219ec31925397cf358b0d965f0597ef5d
-
SHA256
4297e5866beebdedce1e28b89724a9853af982bc39988a38cf3c70db2a98c86a
-
SHA512
c577cc3ca0354acb1333ebeae9b4abd50c088a68fa3bcdd499404f38c8f05b79a3322972d3ff5a729fc89ad4b72f224173a16e8d7f22929f6f41b5b50369baba
-
SSDEEP
24576:3R49/r0wcuSm364suiUv9poYGOecJz/tzYUl8RvIGLlECdB8MIw+RY6ATLZFAgYq:A/Mm31/oLO/58qnRL6LW
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1244 set thread context of 1248 1244 thisIsScary.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1248 vbc.exe 1248 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1248 vbc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1244 wrote to memory of 1248 1244 thisIsScary.exe 28 PID 1244 wrote to memory of 1248 1244 thisIsScary.exe 28 PID 1244 wrote to memory of 1248 1244 thisIsScary.exe 28 PID 1244 wrote to memory of 1248 1244 thisIsScary.exe 28 PID 1244 wrote to memory of 1248 1244 thisIsScary.exe 28 PID 1244 wrote to memory of 1248 1244 thisIsScary.exe 28 PID 1244 wrote to memory of 1248 1244 thisIsScary.exe 28 PID 1244 wrote to memory of 1248 1244 thisIsScary.exe 28 PID 1244 wrote to memory of 1248 1244 thisIsScary.exe 28 PID 1244 wrote to memory of 1248 1244 thisIsScary.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\thisIsScary.exe"C:\Users\Admin\AppData\Local\Temp\thisIsScary.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248
-