Analysis
-
max time kernel
0s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26-12-2023 05:10
General
-
Target
56e4cedb683a9d1c2b482de3d06d9c09.exe
-
Size
1.0MB
-
MD5
56e4cedb683a9d1c2b482de3d06d9c09
-
SHA1
124e7d162912def22d98975df2f0186b5b4af207
-
SHA256
88b19a54e96629881f26ac18f867e1452d76ea240d1aaf6dd9a31c49a75e1a4c
-
SHA512
2325ecfc44d3317c949c568d7f755064e074b11573a366cfc15a35ca9ecaf5c22de6ee104f3f41e86ffee0fae2473948a2ac1b993cb89872024307eeabc49a48
-
SSDEEP
24576:bImhov8yv3Xkl4LhiRNJw4RBzjLIHVnVtH:Lov8yv/did37vuNH
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Program crash 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56e4cedb683a9d1c2b482de3d06d9c09.exe"C:\Users\Admin\AppData\Local\Temp\56e4cedb683a9d1c2b482de3d06d9c09.exe"1⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 1281⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 1561⤵
- Program crash
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB