8641e1062420633a19c065f0c61b522a072933d482c6ba2f1ca477e9ee1f0ad4

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 17:04

Target

e229fe5ae716ba9812100d3489cd5f30.exe
Size

598KB
MD5

e229fe5ae716ba9812100d3489cd5f30
SHA1

5d3c974c3efa7c1bd4e73c8059131d42a73f59f5
SHA256

8641e1062420633a19c065f0c61b522a072933d482c6ba2f1ca477e9ee1f0ad4
SHA512

854ddc92c2eb25ce4e3afb4266c7f8938b59c2472df27de8b248ef1fd0a12864ed90faed9b73affc5ffb8db1386db3674f6328efb4e13cdbaff4d4aac77e91f1
SSDEEP

12288:BbL2N6YXe4u/cwWnoEWz1d5IbcjIgPr13NbuTJ7DOZzOSOYUh8T6UMH:R4V7

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

vbc.exe

pid process

1300 vbc.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

e229fe5ae716ba9812100d3489cd5f30.exe

description pid process target process

PID 4360 set thread context of 1300 4360 e229fe5ae716ba9812100d3489cd5f30.exe vbc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2700 1300 WerFault.exe vbc.exe

pid	process
1300	vbc.exe

description	pid	process	target process
PID 4360 set thread context of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe

pid	pid_target	process	target process
2700	1300	WerFault.exe	vbc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e229fe5ae716ba9812100d3489cd5f30.exe

description	pid	process	target process
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe
PID 4360 wrote to memory of 1300	4360	e229fe5ae716ba9812100d3489cd5f30.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
C:\Users\Admin\AppData\Local\Temp\vbc.exe
2⤵
- Executes dropped EXE
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 140
3⤵
- Program crash
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1300 -ip 1300
1⤵
PID:2008

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\vbc.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/1300-5-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4360-0-0x00000000745B0000-0x0000000074B61000-memory.dmp

Filesize
5.7MB

Download
memory/4360-1-0x00000000745B0000-0x0000000074B61000-memory.dmp

Filesize
5.7MB

Download
memory/4360-2-0x0000000001B50000-0x0000000001B60000-memory.dmp

Filesize
64KB

Download
memory/4360-8-0x00000000745B0000-0x0000000074B61000-memory.dmp

Filesize
5.7MB

Download