70d17044bbc13f69ddc346ff87f742b8a97bef3da81e1c986f6ff3ec70a77584

Analysis

max time kernel
152s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/08/2023, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8aba0879d92cfe48941218b64cd49e27.exe
Size 3.8MB
Sample230820-nsaknagg7x
SHA256 70d17044bbc13f69ddc346ff87f742b8a97bef3da81e1c986f6ff3ec70a77584
MD5 8aba0879d92cfe48941218b64cd49e27
SHA1 1c07f2058ff40822305a800030b54b05f8cc5fd1
SHA512 bbeb946ee62a573c4afdc13a79aa0a5d03e769f86aa19efcacd7b5595319dfddb7d2a0b22c24f78e370501daa510828348d59d8e346bb5a1a43206a829071a3f
SSDEEP 24576:7jZ5Vc+9aPE2dEdTMoNQ6oTMpidFN8nIsE70NIdi9nQgbdaS0/m6Fq6T3SMd7V+Q:7q+9aPE22bcOiCIsE70No6Md7V+qDB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 2292	2236	8aba0879d92cfe48941218b64cd49e27.exe	32

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2604	2236	8aba0879d92cfe48941218b64cd49e27.exe	28
PID 2236 wrote to memory of 2604	2236	8aba0879d92cfe48941218b64cd49e27.exe	28
PID 2236 wrote to memory of 2604	2236	8aba0879d92cfe48941218b64cd49e27.exe	28
PID 2236 wrote to memory of 2604	2236	8aba0879d92cfe48941218b64cd49e27.exe	28
PID 2236 wrote to memory of 1964	2236	8aba0879d92cfe48941218b64cd49e27.exe	29
PID 2236 wrote to memory of 1964	2236	8aba0879d92cfe48941218b64cd49e27.exe	29
PID 2236 wrote to memory of 1964	2236	8aba0879d92cfe48941218b64cd49e27.exe	29
PID 2236 wrote to memory of 1964	2236	8aba0879d92cfe48941218b64cd49e27.exe	29
PID 2236 wrote to memory of 2000	2236	8aba0879d92cfe48941218b64cd49e27.exe	30
PID 2236 wrote to memory of 2000	2236	8aba0879d92cfe48941218b64cd49e27.exe	30
PID 2236 wrote to memory of 2000	2236	8aba0879d92cfe48941218b64cd49e27.exe	30
PID 2236 wrote to memory of 2000	2236	8aba0879d92cfe48941218b64cd49e27.exe	30
PID 2236 wrote to memory of 1728	2236	8aba0879d92cfe48941218b64cd49e27.exe	31
PID 2236 wrote to memory of 1728	2236	8aba0879d92cfe48941218b64cd49e27.exe	31
PID 2236 wrote to memory of 1728	2236	8aba0879d92cfe48941218b64cd49e27.exe	31
PID 2236 wrote to memory of 1728	2236	8aba0879d92cfe48941218b64cd49e27.exe	31
PID 2236 wrote to memory of 2292	2236	8aba0879d92cfe48941218b64cd49e27.exe	32
PID 2236 wrote to memory of 2292	2236	8aba0879d92cfe48941218b64cd49e27.exe	32
PID 2236 wrote to memory of 2292	2236	8aba0879d92cfe48941218b64cd49e27.exe	32
PID 2236 wrote to memory of 2292	2236	8aba0879d92cfe48941218b64cd49e27.exe	32
PID 2236 wrote to memory of 2292	2236	8aba0879d92cfe48941218b64cd49e27.exe	32
PID 2236 wrote to memory of 2292	2236	8aba0879d92cfe48941218b64cd49e27.exe	32

C:\Users\Admin\AppData\Local\Temp\8aba0879d92cfe48941218b64cd49e27.exe
"C:\Users\Admin\AppData\Local\Temp\8aba0879d92cfe48941218b64cd49e27.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-54-0x0000000000160000-0x000000000053E000-memory.dmp

Download

memory/2236-77-0x0000000000160000-0x000000000053E000-memory.dmp

Download

memory/2292-55-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2292-57-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2292-74-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2292-78-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2292-79-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2292-80-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/2292-82-0x0000000000400000-0x000000000056C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads