Resubmissions

06-01-2025 13:01

250106-p9jekaxkcx 10

13-10-2024 23:16

241013-289lkssepc 10

14-03-2023 17:05

230314-vl5ksagf73 7

14-03-2023 16:59

230314-vhej7agf56 7

Analysis

  • max time kernel
    136s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-03-2023 16:59

General

  • Target

    thisIsScary.exe

  • Size

    746.2MB

  • MD5

    f359144193a123071150ae6d7c998a2e

  • SHA1

    f521e43219ec31925397cf358b0d965f0597ef5d

  • SHA256

    4297e5866beebdedce1e28b89724a9853af982bc39988a38cf3c70db2a98c86a

  • SHA512

    c577cc3ca0354acb1333ebeae9b4abd50c088a68fa3bcdd499404f38c8f05b79a3322972d3ff5a729fc89ad4b72f224173a16e8d7f22929f6f41b5b50369baba

  • SSDEEP

    24576:3R49/r0wcuSm364suiUv9poYGOecJz/tzYUl8RvIGLlECdB8MIw+RY6ATLZFAgYq:A/Mm31/oLO/58qnRL6LW

Score
7/10

Malware Config

Signatures

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\thisIsScary.exe
    "C:\Users\Admin\AppData\Local\Temp\thisIsScary.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4536

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4536-133-0x0000000001390000-0x00000000013D6000-memory.dmp

    Filesize

    280KB

  • memory/4536-134-0x0000000005ED0000-0x00000000064E8000-memory.dmp

    Filesize

    6.1MB

  • memory/4536-135-0x0000000005970000-0x0000000005982000-memory.dmp

    Filesize

    72KB

  • memory/4536-136-0x0000000005AA0000-0x0000000005BAA000-memory.dmp

    Filesize

    1.0MB

  • memory/4536-137-0x00000000059D0000-0x0000000005A0C000-memory.dmp

    Filesize

    240KB

  • memory/4536-138-0x0000000005A60000-0x0000000005A70000-memory.dmp

    Filesize

    64KB

  • memory/4536-139-0x0000000005D30000-0x0000000005D96000-memory.dmp

    Filesize

    408KB

  • memory/4536-140-0x0000000006DE0000-0x0000000007384000-memory.dmp

    Filesize

    5.6MB

  • memory/4536-141-0x0000000006910000-0x00000000069A2000-memory.dmp

    Filesize

    584KB

  • memory/4536-142-0x00000000069B0000-0x0000000006A26000-memory.dmp

    Filesize

    472KB

  • memory/4536-143-0x0000000006C00000-0x0000000006DC2000-memory.dmp

    Filesize

    1.8MB

  • memory/4536-144-0x00000000078C0000-0x0000000007DEC000-memory.dmp

    Filesize

    5.2MB

  • memory/4536-145-0x0000000006B50000-0x0000000006B6E000-memory.dmp

    Filesize

    120KB