5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe
Size 12KB
Sample240602-2jfl7she7x
SHA256 5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f
MD5 90140da9dd0064d5e7e7faeef8df6058
SHA1 187ad926180b3aac26b47001819ad301d650f528
SHA512 49776fb6f01a63582f92209ded62a4979064d96de94a74ecbede1569adac132ae894912ddb6eee388e3d63159a5b0434c11a5e289fc70fd2f534a1e60a1039ff
SSDEEP 384:GL7li/2zXq2DcEQvdQcJKLTp/NK9xa5F:gTMCQ9c5F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2672	tmp29DF.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2672	tmp29DF.tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
2756	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2212	2756	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	28
PID 2756 wrote to memory of 2212	2756	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	28
PID 2756 wrote to memory of 2212	2756	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	28
PID 2756 wrote to memory of 2212	2756	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	28
PID 2212 wrote to memory of 2576	2212	vbc.exe	30
PID 2212 wrote to memory of 2576	2212	vbc.exe	30
PID 2212 wrote to memory of 2576	2212	vbc.exe	30
PID 2212 wrote to memory of 2576	2212	vbc.exe	30
PID 2756 wrote to memory of 2672	2756	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	31
PID 2756 wrote to memory of 2672	2756	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	31
PID 2756 wrote to memory of 2672	2756	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	31
PID 2756 wrote to memory of 2672	2756	5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe	31

C:\Users\Admin\AppData\Local\Temp\5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe
"C:\Users\Admin\AppData\Local\Temp\5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2ahcbcrc\2ahcbcrc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B93.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA6BBA7F05F274DB98984F96356616C6B.TMP"
    3⤵
    PID:2576
- C:\Users\Admin\AppData\Local\Temp\tmp29DF.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp29DF.tmp.exe" C:\Users\Admin\AppData\Local\Temp\5e471fefad350018ed05f175822f5ec09cc6fbaa614fda94ed8865e0187ae07f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2ahcbcrc.0.vb

Path C:\Users\Admin\AppData\Local\Temp\2ahcbcrc\2ahcbcrc.0.vb
Size 2KB
SHA256 4f792649ec63b122693dcf82c136917ebed21ec89542e1adab9f1e9721437104
MD5 8275e09afcf73d7c03d33c41410bf5fb
SHA1 04b96ca4d5ba0ad91e46b65c0086ffb7bc59c120
SHA512 98749c53d1bd86df878df065deb904833d8dbe70cf38368a88f1573ce3083fca38471ca16201dcb1e2b213163ae47ca806b8711e41861a53cb9d50dbbc9fff29
MD5 SHA1 SHA512

Submit Download

2ahcbcrc.cmdline

Path C:\Users\Admin\AppData\Local\Temp\2ahcbcrc\2ahcbcrc.cmdline
Size 273B
SHA256 6ec941eecd91bee7bac7042d7a82f268b7c40519bbd1eb04990b497d8fb96a6e
MD5 0ffdfa2cace5e29e2dfef286c22f1fa6
SHA1 ffc04b5769a3bd0e0b1b759236d0ba5fb7ce56d0
SHA512 bb2a3d4b548f15e86d991a9eead413c3e7446e72531a36a2640de7abc2f982b799c9d98dbd1589153bcc78b6183a41e240a033f56745269b047fe195959b6434
MD5 SHA1 SHA512

Submit Download

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 75871cd68334459d34e0393470d72c55128f44431bd7059f21cdea42e58e4cad
MD5 6a6784655e370cd4beecd989ff0f57ff
SHA1 90fa0625974031a6738edc6ed91ceca0393925c7
SHA512 5083d4c3ca29570785c9db037efeb594ca48a5622790f407263bc028fbbfa0b696427f15f40bef9ba4a009da62cec109a4429024dd880079b8f2e688ddfd9206
MD5 SHA1 SHA512

Submit Download

RES2B93.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2B93.tmp
Size 1KB
SHA256 e7657b022da976f8aa8d7489c3e0d0e6b2a54e9334c10ae90d6512988d68d51f
MD5 08d5f093428433f185325a619b9e1968
SHA1 807b4a92fcb7ae4e45e5eb43b6e4085af9589f8d
SHA512 81c95f8011b57f62ea00961933b48d5b6095e1155c71940bcd7e8ffc03117988eac00b882f6734073ac5775b960770be866de8a66169db2c3545a35db45c1118
MD5 SHA1 SHA512

Submit Download

tmp29DF.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp29DF.tmp.exe
Size 12KB
SHA256 757ce931173ff3229a4c8a23f1aaec4716d5dd1b023a4f68efd7a830fb3d14ae
MD5 27afdd92fac59c83f1715a6ba8608d59
SHA1 a7eb711f0150ce898fcefc3e9bbbb36acdd1593a
SHA512 9424af9bcbca5f8da050811aa36db9e834e2661a1839e90a8e4dc3523eb4a669daad4dfc6777a1242ebf04ee6e6031ba21461fff0acd0d6adb9286b113c477d1
SSDEEP 384:UL7li/2zfq2DcEQvdQcJKLTp/NK9xa2nD:CrMCQ9ckD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcA6BBA7F05F274DB98984F96356616C6B.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcA6BBA7F05F274DB98984F96356616C6B.TMP
Size 1KB
SHA256 e1c7b07a393cbce1ebf413527d3baecc8bb05f88d047949cd7a6a3bcb0663a64
MD5 7b4c7773bd71a997445f264c6a352e07
SHA1 4604df42c5a8332583ef75197df6d97d9e9235b7
SHA512 9e694ccf798fefa0b2fbe9b4fe17b725906dd51986a0a6272754d71efdce316ce765cf01b9203608a68d0e422fdf7da635085397c2824f8c9a09406d8cf2884d
MD5 SHA1 SHA512

Submit Download

memory/2672-23-0x00000000001F0000-0x00000000001FA000-memory.dmp

Download

memory/2756-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Download

memory/2756-1-0x0000000000D90000-0x0000000000D9A000-memory.dmp

Download

memory/2756-7-0x0000000074B10000-0x00000000751FE000-memory.dmp

Download

memory/2756-24-0x0000000074B10000-0x00000000751FE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads