fc7291766af24760ecc65ce9ea7e342ded300d8d7f4c883b7055ec0f060ecaf5

General

Target

virussign.com_9d0c08e9397f1b734de76cfce378f320.exe
Size

12KB
MD5

9d0c08e9397f1b734de76cfce378f320
SHA1

bae676d1e7c3fe8d86bb252e040087a35f9c965e
SHA256

fc7291766af24760ecc65ce9ea7e342ded300d8d7f4c883b7055ec0f060ecaf5
SHA512

7587af76f33e1013a3336f84e23deaedf4d95d218f657c5bf3dd4da452c3291a267f9cc5c87e70921e1cb25005589aa165b410afd1e7fdc2e762dac3ddca0f01
SSDEEP

384:1L7li/2zxq2DcEQvdhcJKLTp/NK9xa+E:VxM/Q9c+E

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2744	tmp1ED7.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2744	tmp1ED7.tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	virussign.com_9d0c08e9397f1b734de76cfce378f320.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	virussign.com_9d0c08e9397f1b734de76cfce378f320.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2344	1964	virussign.com_9d0c08e9397f1b734de76cfce378f320.exe	28
PID 1964 wrote to memory of 2344	1964	virussign.com_9d0c08e9397f1b734de76cfce378f320.exe	28
PID 1964 wrote to memory of 2344	1964	virussign.com_9d0c08e9397f1b734de76cfce378f320.exe	28
PID 1964 wrote to memory of 2344	1964	virussign.com_9d0c08e9397f1b734de76cfce378f320.exe	28
PID 2344 wrote to memory of 2520	2344	vbc.exe	30
PID 2344 wrote to memory of 2520	2344	vbc.exe	30
PID 2344 wrote to memory of 2520	2344	vbc.exe	30
PID 2344 wrote to memory of 2520	2344	vbc.exe	30
PID 1964 wrote to memory of 2744	1964	virussign.com_9d0c08e9397f1b734de76cfce378f320.exe	31
PID 1964 wrote to memory of 2744	1964	virussign.com_9d0c08e9397f1b734de76cfce378f320.exe	31
PID 1964 wrote to memory of 2744	1964	virussign.com_9d0c08e9397f1b734de76cfce378f320.exe	31
PID 1964 wrote to memory of 2744	1964	virussign.com_9d0c08e9397f1b734de76cfce378f320.exe	31

C:\Users\Admin\AppData\Local\Temp\virussign.com_9d0c08e9397f1b734de76cfce378f320.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_9d0c08e9397f1b734de76cfce378f320.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l4zxscgc\l4zxscgc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FE0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3B7136664CB4547A036F438B761D9A2.TMP"
    3⤵
    PID:2520
- C:\Users\Admin\AppData\Local\Temp\tmp1ED7.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp1ED7.tmp.exe" C:\Users\Admin\AppData\Local\Temp\virussign.com_9d0c08e9397f1b734de76cfce378f320.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RE.resources

Filesize
2KB

MD5
2bef879f76e86248e33dbb26c29c5327

SHA1
7f8b2a7e0566bd2477cd54c94e12afbfb3ec5706

SHA256
d2bf3e94198b9bc5f600eff6907f06fbd398f103329ca99f1622cf3a330f7224

SHA512
081d8bde408fa1173b0fe186ba385f63c33214ddcc0ca0b3b84ff6ea5c725297ebf9d66b1a06b6e1ef95ad11284c7b8819bf2af2efdcc9e14de8902c77840a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1FE0.tmp

Filesize
1KB

MD5
7fc56cd5bea98cb6222c7f67feed2ae4

SHA1
51666eab12a74fe5b9249835d6482df40cae23ba

SHA256
6bde2c191ec39c034613a762da92f89aab5030f2e31e3da4e5e5133c47149556

SHA512
a69fd0ac7bfc166490318d21fe31db0660a458e2fcb5d79d6c1611aee223f452e371f3aa1ed49d20a7930bb8830466683f114630b55109b32044343fa54c1e8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\l4zxscgc\l4zxscgc.0.vb

Filesize
2KB

MD5
743c0f1d6a8c07a7084a7e51101e40c2

SHA1
adac4977b644007caa1f5d599e10385eaf402882

SHA256
9c9371daa866166f7cbf5cd1bf81b103d61b162138678237e2b5f2abbbf08949

SHA512
017e16f963697a1fe337747ec6841d743cdc860680d261a18b825f9777ba63403eaa5b2f747f5520b9b221f5a18e8bb564a54efd7b54c01c4f31120e168b5ba0

Download Submit
C:\Users\Admin\AppData\Local\Temp\l4zxscgc\l4zxscgc.cmdline

Filesize
273B

MD5
0e9d5269e5175bb8358a035fdad7f8a4

SHA1
3cdcfa2cc8c9d563a93ef478857a5347c60ee94e

SHA256
b825949b76dc054e3a7d99deb476f162d5af26efe48508de19ef4d98b0aef181

SHA512
21c61eb96e7310c3c5e0c8a0cf978de5c7212089560082b53991d49d602f6d7dab00e3c9277b48267a3d3839f3888e72ca9e2a964829d7bf65c1df66f5ac75b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1ED7.tmp.exe

Filesize
12KB

MD5
8910ed1406f093095cfbc85e486bf887

SHA1
6fd8d7b775e4c5500e98fd307cc0b06aea679990

SHA256
f738e8466888bc677c6f1492b222ccd0a87a287e0244c363bd18af9dd4398455

SHA512
75ed6682cea83bce22f63ba1808f1e16e2b9f844a1ce1e10794d4dd1d0089f4336b8d6c9bb2ad421687e9ca4fb5805d85c0fa295691113e9cff57825695341f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc3B7136664CB4547A036F438B761D9A2.TMP

Filesize
1KB

MD5
cfecafbfa51d4bac4795763991a0c286

SHA1
a4f00001399f497d51182695d09a1b263ef232dc

SHA256
94d6434e52f9d7f448a485735dbca36e77a0c2fb8f9638dc78d2d9f8eaed4365

SHA512
2a000b854ff6eff3ad288d8797b10e46196d3d1bd448c74f3ff7eb273a4dd9a09fdab57ea8403c2178a91e787a510541f33bb759be8bad4e2538f8ef1c94e200

Download Submit
memory/1964-0-0x00000000745FE000-0x00000000745FF000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download
memory/1964-7-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/1964-24-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/2744-23-0x0000000000060000-0x000000000006A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing