93b16aa9542c8f7cc4b6cf48ce2f51cb3b97b71f055792d21209854cefb87d1a

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9650e00ef30bc7abe8becec63619e47c.exe
Size

516KB
MD5

9650e00ef30bc7abe8becec63619e47c
SHA1

295a2a3b936f4d59134f0f9a1869220784de8a66
SHA256

93b16aa9542c8f7cc4b6cf48ce2f51cb3b97b71f055792d21209854cefb87d1a
SHA512

cbb68eca8094820f85242284663023f0bbc54d18a60c5f9eacae0db9ab32166e3b23c052b6861bc059ebd819b195af91a84f49cbeb48163083b1a3e5d2d43ff3
SSDEEP

12288:IDOCHBIeaaSjCSwtqg3lgvGJCSWMiHaWvwLU4U9xjZ:IMj0Wl+8VMiLr

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\facebook.exe = "C:\\Users\\Admin\\AppData\\Roaming\\facebook.exe:*:Enabled:Windows Messanger"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VirusUpdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\facebook.exe"	vbc.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD3BA2E0-17DD-D3FB-DFEA-4BEAC1FE7DCA}	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD3BA2E0-17DD-D3FB-DFEA-4BEAC1FE7DCA}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\facebook.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FD3BA2E0-17DD-D3FB-DFEA-4BEAC1FE7DCA}	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FD3BA2E0-17DD-D3FB-DFEA-4BEAC1FE7DCA}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\facebook.exe"	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VirusUpdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\facebook.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VirusUpdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\facebook.exe"	vbc.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	9650e00ef30bc7abe8becec63619e47c.exe
File opened for modification	C:\autorun.inf	9650e00ef30bc7abe8becec63619e47c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4976 set thread context of 4872	4976	9650e00ef30bc7abe8becec63619e47c.exe	84

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	vbc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4464	reg.exe
2948	reg.exe
2076	reg.exe
3816	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4976	9650e00ef30bc7abe8becec63619e47c.exe
4976	9650e00ef30bc7abe8becec63619e47c.exe
4976	9650e00ef30bc7abe8becec63619e47c.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	9650e00ef30bc7abe8becec63619e47c.exe
Token: SeRestorePrivilege	384	dw20.exe
Token: SeBackupPrivilege	384	dw20.exe
Token: 1	4872	vbc.exe
Token: SeCreateTokenPrivilege	4872	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	4872	vbc.exe
Token: SeLockMemoryPrivilege	4872	vbc.exe
Token: SeIncreaseQuotaPrivilege	4872	vbc.exe
Token: SeMachineAccountPrivilege	4872	vbc.exe
Token: SeTcbPrivilege	4872	vbc.exe
Token: SeSecurityPrivilege	4872	vbc.exe
Token: SeTakeOwnershipPrivilege	4872	vbc.exe
Token: SeLoadDriverPrivilege	4872	vbc.exe
Token: SeSystemProfilePrivilege	4872	vbc.exe
Token: SeSystemtimePrivilege	4872	vbc.exe
Token: SeProfSingleProcessPrivilege	4872	vbc.exe
Token: SeIncBasePriorityPrivilege	4872	vbc.exe
Token: SeCreatePagefilePrivilege	4872	vbc.exe
Token: SeCreatePermanentPrivilege	4872	vbc.exe
Token: SeBackupPrivilege	4872	vbc.exe
Token: SeRestorePrivilege	4872	vbc.exe
Token: SeShutdownPrivilege	4872	vbc.exe
Token: SeDebugPrivilege	4872	vbc.exe
Token: SeAuditPrivilege	4872	vbc.exe
Token: SeSystemEnvironmentPrivilege	4872	vbc.exe
Token: SeChangeNotifyPrivilege	4872	vbc.exe
Token: SeRemoteShutdownPrivilege	4872	vbc.exe
Token: SeUndockPrivilege	4872	vbc.exe
Token: SeSyncAgentPrivilege	4872	vbc.exe
Token: SeEnableDelegationPrivilege	4872	vbc.exe
Token: SeManageVolumePrivilege	4872	vbc.exe
Token: SeImpersonatePrivilege	4872	vbc.exe
Token: SeCreateGlobalPrivilege	4872	vbc.exe
Token: 31	4872	vbc.exe
Token: 32	4872	vbc.exe
Token: 33	4872	vbc.exe
Token: 34	4872	vbc.exe
Token: 35	4872	vbc.exe
Token: SeBackupPrivilege	384	dw20.exe
Token: SeBackupPrivilege	384	dw20.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4872	vbc.exe
4872	vbc.exe
4872	vbc.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4872	4976	9650e00ef30bc7abe8becec63619e47c.exe	84
PID 4976 wrote to memory of 4872	4976	9650e00ef30bc7abe8becec63619e47c.exe	84
PID 4976 wrote to memory of 4872	4976	9650e00ef30bc7abe8becec63619e47c.exe	84
PID 4976 wrote to memory of 4872	4976	9650e00ef30bc7abe8becec63619e47c.exe	84
PID 4976 wrote to memory of 4872	4976	9650e00ef30bc7abe8becec63619e47c.exe	84
PID 4976 wrote to memory of 4872	4976	9650e00ef30bc7abe8becec63619e47c.exe	84
PID 4976 wrote to memory of 4872	4976	9650e00ef30bc7abe8becec63619e47c.exe	84
PID 4976 wrote to memory of 4872	4976	9650e00ef30bc7abe8becec63619e47c.exe	84
PID 4976 wrote to memory of 384	4976	9650e00ef30bc7abe8becec63619e47c.exe	85
PID 4976 wrote to memory of 384	4976	9650e00ef30bc7abe8becec63619e47c.exe	85
PID 4976 wrote to memory of 384	4976	9650e00ef30bc7abe8becec63619e47c.exe	85
PID 4872 wrote to memory of 4660	4872	vbc.exe	86
PID 4872 wrote to memory of 4660	4872	vbc.exe	86
PID 4872 wrote to memory of 4660	4872	vbc.exe	86
PID 4872 wrote to memory of 4496	4872	vbc.exe	87
PID 4872 wrote to memory of 4496	4872	vbc.exe	87
PID 4872 wrote to memory of 4496	4872	vbc.exe	87
PID 4872 wrote to memory of 4448	4872	vbc.exe	91
PID 4872 wrote to memory of 4448	4872	vbc.exe	91
PID 4872 wrote to memory of 4448	4872	vbc.exe	91
PID 4872 wrote to memory of 4588	4872	vbc.exe	89
PID 4872 wrote to memory of 4588	4872	vbc.exe	89
PID 4872 wrote to memory of 4588	4872	vbc.exe	89
PID 4496 wrote to memory of 2948	4496	cmd.exe	94
PID 4496 wrote to memory of 2948	4496	cmd.exe	94
PID 4496 wrote to memory of 2948	4496	cmd.exe	94
PID 4448 wrote to memory of 3816	4448	cmd.exe	96
PID 4448 wrote to memory of 3816	4448	cmd.exe	96
PID 4448 wrote to memory of 3816	4448	cmd.exe	96
PID 4588 wrote to memory of 2076	4588	cmd.exe	95
PID 4588 wrote to memory of 2076	4588	cmd.exe	95
PID 4588 wrote to memory of 2076	4588	cmd.exe	95
PID 4660 wrote to memory of 4464	4660	cmd.exe	97
PID 4660 wrote to memory of 4464	4660	cmd.exe	97
PID 4660 wrote to memory of 4464	4660	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\9650e00ef30bc7abe8becec63619e47c.exe
"C:\Users\Admin\AppData\Local\Temp\9650e00ef30bc7abe8becec63619e47c.exe"
1⤵
- Drops autorun.inf file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\facebook.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\facebook.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\facebook.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\facebook.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:3816
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 868
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4872-25-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-31-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-36-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-35-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-22-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-23-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-32-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-26-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-27-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-28-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4872-29-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4976-0-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4976-1-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4976-21-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4976-2-0x0000000001AA0000-0x0000000001AB0000-memory.dmp

Filesize
64KB

Download