27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe
Size 12KB
Sample240606-y239fabe3x
SHA256 27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc
MD5 5ea53b070a1abe64c5bf612c3b2e04aa
SHA1 924593ee4788460ee1910dd8c1f162b4d3ee4acf
SHA512 33986845e9921b17d89cb792d9d16fb13c0c1e9b0e79c05615bfef9d6faf5bfd7db11adee9292a22d763f58853c40136c1eaedb1b1618a437e834952833441fc
SSDEEP 384:2L7li/2zfq2DcEQvdhcJKLTp/NK9xafk:wjM/Q9cfk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2724	tmp2434.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2724	tmp2434.tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
2432	27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3004	2432	27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe	28
PID 2432 wrote to memory of 3004	2432	27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe	28
PID 2432 wrote to memory of 3004	2432	27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe	28
PID 2432 wrote to memory of 3004	2432	27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe	28
PID 3004 wrote to memory of 2672	3004	vbc.exe	30
PID 3004 wrote to memory of 2672	3004	vbc.exe	30
PID 3004 wrote to memory of 2672	3004	vbc.exe	30
PID 3004 wrote to memory of 2672	3004	vbc.exe	30
PID 2432 wrote to memory of 2724	2432	27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe	31
PID 2432 wrote to memory of 2724	2432	27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe	31
PID 2432 wrote to memory of 2724	2432	27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe	31
PID 2432 wrote to memory of 2724	2432	27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe	31

C:\Users\Admin\AppData\Local\Temp\27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe
"C:\Users\Admin\AppData\Local\Temp\27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\01suwmkc\01suwmkc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES25D8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc82E02B5134574E00BE98795D90C88121.TMP"
    3⤵
    PID:2672
- C:\Users\Admin\AppData\Local\Temp\tmp2434.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp2434.tmp.exe" C:\Users\Admin\AppData\Local\Temp\27570fbff39f285ffcafe016c32dd3457f3843a1485893abb4e1b53f89fcbccc.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01suwmkc.0.vb

Path C:\Users\Admin\AppData\Local\Temp\01suwmkc\01suwmkc.0.vb
Size 2KB
SHA256 b946d388d97dab5e03507876b4a098a861d0005e5afec58ff1b2188754da1bbd
MD5 c44a6f26bc1212df80e51063d5615249
SHA1 9c44201b9ed760f04d819cf9e9419c3e032b1cad
SHA512 49e4e2b38b72ca939258fbb2c25bae45530281b131b5adf248c54e521423d0a2f7fb7c4af5bd27269794655fadf917dca54860a2e8af2c050d9abe221cc5c166
MD5 SHA1 SHA512

Submit Download

01suwmkc.cmdline

Path C:\Users\Admin\AppData\Local\Temp\01suwmkc\01suwmkc.cmdline
Size 273B
SHA256 2b77f42e1018ec8cf15627f1ba74e639b4589b5e251545f0fe9f2c1dbab8a3a2
MD5 dc573662b38be1561dce4989385bc4fe
SHA1 2e22b6adac92493a5e5660106e4ca946f39deefb
SHA512 69b8c3179a01ffd79ccda1c2cbf3808179796e019096feeda2efddaf6f75b3f33edc9ad2d83d1ff433b3aec69f12e248e4a82441f2dbe1f7409cc88250dc05bc
MD5 SHA1 SHA512

Submit Download

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 0fca4656177f16f210a332e5849176ec948b711aecbe97561997494b5a84398b
MD5 59173572abb305eac222dedcf56ce33f
SHA1 830f6178da21a1fd363eddfd0748579157f9ffa2
SHA512 c9176910792462207d13eb89bcdd951a17fb3819c180730641c521e2759758f3f07f9a1ff5ec09ddd40555cff780e5b0169e4944f34b22a7e7fb4daf8fbba5d1
MD5 SHA1 SHA512

Submit Download

RES25D8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES25D8.tmp
Size 1KB
SHA256 367c38a8edd9fb148172c2ad60e604b191cc8b4495f5bc9e299e103cdd50fa4d
MD5 67acaa9ee22aaa2e23dd176ae474a7ad
SHA1 6070ad4b8840f0cf7937dce5aee51b8999df0c7a
SHA512 28d2a11ea6c257dfbade75d5637a8ff2603b7b360b660255fcd77b76ac03600e78cbfb080354f6e00fda944f186f9947cad231ee0dc87ceccfc7a8e0d234dfc1
MD5 SHA1 SHA512

Submit Download

tmp2434.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp2434.tmp.exe
Size 12KB
SHA256 7adb66c3a4f7fa692a5443022a8a12adff960d550a39883dd42ffdf14efc3bbd
MD5 bb025104591db40d989459b533967697
SHA1 93e9af1e9a3d64c047adf1765f3056bbb6032b96
SHA512 07b36d4174400a40e951b4bbe73f82fe6ade92b9cece6adad8489f06f4f5ef8a18e02971947506e24765fbc1da7234579003a1c9010be79d698a6c7f89df3e81
SSDEEP 384:5L7li/2z2q2DcEQvdQcJKLTp/NK9xaXT:J+MCQ9cXT
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc82E02B5134574E00BE98795D90C88121.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc82E02B5134574E00BE98795D90C88121.TMP
Size 1KB
SHA256 d257bfbca5c850ceb8e39b0b8046801418a677253e5adcaf1e788e1ad1d7e5fe
MD5 4966ffe7904da32cfb4a029db6bfa70c
SHA1 25b7f5263f8c4e7fe267959c073ad5aeaa2eaeec
SHA512 81fb8b0e594c18b18dc121ebbcae3ce57660a9df62793f6de8d55e77933a791c95d9fb60895de5b68cb711c953d47db8198beddf39ae3a0ca06034196efaaa72
MD5 SHA1 SHA512

Submit Download

memory/2432-0-0x00000000742AE000-0x00000000742AF000-memory.dmp

Download

memory/2432-1-0x00000000002D0000-0x00000000002DA000-memory.dmp

Download

memory/2432-8-0x00000000742A0000-0x000000007498E000-memory.dmp

Download

memory/2432-23-0x00000000742A0000-0x000000007498E000-memory.dmp

Download

memory/2724-24-0x0000000000280000-0x000000000028A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads