Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    08-04-2024 23:32

General

  • Target

    87f01bf0a9bcb58861dff18fce3cdca8e62568b03f5bbec49ad6b5b290465170.exe

  • Size

    78KB

  • MD5

    5c31bc8753446e3b507dbfdee6d9270c

  • SHA1

    2469bb398e293b0c9be5585272e99837c2138b96

  • SHA256

    87f01bf0a9bcb58861dff18fce3cdca8e62568b03f5bbec49ad6b5b290465170

  • SHA512

    238e63ffb5e7231b968443edb19adc5e396e2ac30f514a52977c64806288170bd40f3d727b02eaf1ab5ddf927997e6d3fa14a263310d69cb46a511c74ca4f966

  • SSDEEP

    1536:kWV5jS/dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQty6i9/y1Fa:kWV5jSen7N041Qqhg69/j

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87f01bf0a9bcb58861dff18fce3cdca8e62568b03f5bbec49ad6b5b290465170.exe
    "C:\Users\Admin\AppData\Local\Temp\87f01bf0a9bcb58861dff18fce3cdca8e62568b03f5bbec49ad6b5b290465170.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\smp-owm7.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc889.tmp"
        3⤵
          PID:2104
      • C:\Users\Admin\AppData\Local\Temp\tmp7FC.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp7FC.tmp.exe" C:\Users\Admin\AppData\Local\Temp\87f01bf0a9bcb58861dff18fce3cdca8e62568b03f5bbec49ad6b5b290465170.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:2612

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES88A.tmp

      Filesize

      1KB

      MD5

      0fc173cff110e340b2bc236a456cc410

      SHA1

      9a05da13df61d79e6eb8d962eb60063a80ebee6f

      SHA256

      394bc77b34f56cf960c32a33e8024b74c0668dbed89664663179346d00d75962

      SHA512

      263f31b4dc5c4a6b3511d3355d10ae5f2fbf20c61540329f2b2778ed1a4d0594f3c88ca409b72f70113d4e85e3a8b672f38bc27c2667a231d21e131be3d6dbca

    • C:\Users\Admin\AppData\Local\Temp\smp-owm7.0.vb

      Filesize

      14KB

      MD5

      c01f9a12a067f9e810fff6da1159cd7a

      SHA1

      abec896c9b69a6253dc4c7ac8686a30bfc787fc6

      SHA256

      26901d3d408e4ad1eb5fc6b62d1df4b62db4d7f033f73f450811578c8edd199a

      SHA512

      509b8928fedd3376d9960535c98ca7b8a55202b6408ea28a40bf94d2b4c4125b43a19753d2ae3c48efde56b2038cf7bc90324de91f65d7866c36257a01558c32

    • C:\Users\Admin\AppData\Local\Temp\smp-owm7.cmdline

      Filesize

      265B

      MD5

      69e7cb35a2cfb4bbe5691028a44700a0

      SHA1

      ea242c2d1cd5b81fc95538aa481710b1d8e23785

      SHA256

      7e54d23bb3dd80d6c3e838ed7904442dfef3ef7b8b3de70ed782c5185e690104

      SHA512

      50c390fc5c25d48ea3fc0561cc60061342276c329550b7975379fac02591cce3688804054cde3fce4bf3e60989b20cb4fd3b6ec3bc2626546b05de13f3dc737c

    • C:\Users\Admin\AppData\Local\Temp\tmp7FC.tmp.exe

      Filesize

      78KB

      MD5

      40606f2ec6a461dc4acdf4721e352c4e

      SHA1

      a743259c48602a3fe6646124b87ce80d8eb58cc9

      SHA256

      209938774aaa18492b4179808660a9f18aedc4e4fddde3ed98df9812c4a86ef6

      SHA512

      f82752316542359febbdd7759f239bd791614347cdb5a78314838bd70551d100a8aa9a9267bf0ea9bef42a14d01dab5bbe63acfa847f69fa8068160b06a61022

    • C:\Users\Admin\AppData\Local\Temp\vbc889.tmp

      Filesize

      660B

      MD5

      aa1532241685f324fcc7bbb98141f702

      SHA1

      31f519675391565279d44ecb7e03f54beb26869c

      SHA256

      7c2d21d3efccb4e9510515aa5939d3ebf6735f51a12833387d2b3b8f728545ac

      SHA512

      7f960a3f4520390b304e8f00298efe2fc4e78bd607cd946e7038036c1ba88141203e81dc9516e240d678768552ae253084140b087c2433326d952a9be6b98750

    • C:\Users\Admin\AppData\Local\Temp\zCom.resources

      Filesize

      62KB

      MD5

      aa4bdac8c4e0538ec2bb4b7574c94192

      SHA1

      ef76d834232b67b27ebd75708922adea97aeacce

      SHA256

      d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

      SHA512

      0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

    • memory/2612-27-0x0000000000B10000-0x0000000000B50000-memory.dmp

      Filesize

      256KB

    • memory/2612-24-0x0000000000B10000-0x0000000000B50000-memory.dmp

      Filesize

      256KB

    • memory/2612-23-0x0000000074720000-0x0000000074CCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2612-25-0x0000000074720000-0x0000000074CCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2612-28-0x0000000074720000-0x0000000074CCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2612-29-0x0000000000B10000-0x0000000000B50000-memory.dmp

      Filesize

      256KB

    • memory/2612-30-0x0000000000B10000-0x0000000000B50000-memory.dmp

      Filesize

      256KB

    • memory/2748-0-0x0000000074720000-0x0000000074CCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2748-1-0x0000000001E90000-0x0000000001ED0000-memory.dmp

      Filesize

      256KB

    • memory/2748-22-0x0000000074720000-0x0000000074CCB000-memory.dmp

      Filesize

      5.7MB

    • memory/2748-2-0x0000000074720000-0x0000000074CCB000-memory.dmp

      Filesize

      5.7MB