bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe
Size 12KB
Sample240609-jvb42sgf48
SHA256 bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015
MD5 b3025a44dd8c24ce11916990dbea9b50
SHA1 92f2782b049755d9076baba1c6413b18fd9ab6ea
SHA512 b5686131e067de2d2d3e839832b3fe36f9824ff4322368a5e00c1621bfbd1169f49938cd478bc607d3c3b294e51b6f8a31f94603e17dcdf67e0395cb7d939f2c
SSDEEP 384:NL7li/2z+q2DcEQvdhcJKLTp/NK9xa5T:dOM/Q9c5T
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2664	tmp1D32.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	tmp1D32.tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
1700	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2948	1700	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	29
PID 1700 wrote to memory of 2948	1700	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	29
PID 1700 wrote to memory of 2948	1700	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	29
PID 1700 wrote to memory of 2948	1700	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	29
PID 2948 wrote to memory of 2272	2948	vbc.exe	31
PID 2948 wrote to memory of 2272	2948	vbc.exe	31
PID 2948 wrote to memory of 2272	2948	vbc.exe	31
PID 2948 wrote to memory of 2272	2948	vbc.exe	31
PID 1700 wrote to memory of 2664	1700	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	32
PID 1700 wrote to memory of 2664	1700	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	32
PID 1700 wrote to memory of 2664	1700	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	32
PID 1700 wrote to memory of 2664	1700	bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe	32

C:\Users\Admin\AppData\Local\Temp\bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe
"C:\Users\Admin\AppData\Local\Temp\bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pasbzs5g\pasbzs5g.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E3A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5B5614C64E234DB1A9F3D1C43CC683FA.TMP"
    3⤵
    PID:2272
- C:\Users\Admin\AppData\Local\Temp\tmp1D32.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp1D32.tmp.exe" C:\Users\Admin\AppData\Local\Temp\bd18658d395c0fdfa820b7b913292b3005128b84a08a2100c7c11b2e1c4a8015.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 0e537e1f1179455803cfc4b22f3626167aa7dcb115e7b8cf94855d03f6ea348f
MD5 a1527c67f9483e90a3e12f80f8147fb4
SHA1 cda9b38d937bfc7a761c6fec11141511a4d4d175
SHA512 db57795c9085218ee0ddf63f12ab071509724a19a296c9cff17a12f0a1d45148e8c6dbd1686369e529a72916b5fb410d74dd14bbad36f3812c1d72102968556d
MD5 SHA1 SHA512

Submit Download

RES1E3A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1E3A.tmp
Size 1KB
SHA256 55d3b0e2674bf3133546b56d86d9cba53855af0170456326d904976f491a769b
MD5 38a139554eb0bddef1ce96eddc136bdc
SHA1 fdbdee724b89166fb8d502efcc1cc3689ba7f91b
SHA512 fd7ae7ab40bf46c84ac87d71f63c8b683d1594716a2e849f6da4181cf97e753ee08d312d10e5226c2681f4a65e802e493e229f29d611377f182a08b0edfcc332
MD5 SHA1 SHA512

Submit Download

pasbzs5g.0.vb

Path C:\Users\Admin\AppData\Local\Temp\pasbzs5g\pasbzs5g.0.vb
Size 2KB
SHA256 00fbfffdcc639b09a10c5e3be067e23213513d64e9d366b64b4586840a102b22
MD5 0d1d6fac6de7dbc18f17afc938cd1fa4
SHA1 2ae43f22236768008876228294c18552b8cfe182
SHA512 9ff777253caa1e804c89d866f7b496044b30ec2f68c1cc9bb8d03537936e390a91ca29bcce9f4bd0338c6cea07938d352c8cf932f864da05d212e14fedacafdc
MD5 SHA1 SHA512

Submit Download

pasbzs5g.cmdline

Path C:\Users\Admin\AppData\Local\Temp\pasbzs5g\pasbzs5g.cmdline
Size 273B
SHA256 4fe173dc934074624ae3edd6ec1a24bae77b596d75e3a7e9310a14a3a18d3211
MD5 6166d560bd4f2f056ad917f5b5bc1cab
SHA1 15ef3e05910a57d04379547ae1c165973a2ccda8
SHA512 dcd19f8b7cfa30fcb635fac0f0087de55666c031788d9afc5fa0679e4688f8182debf4aa30ecd1eead2c0a6e3318f16cd89477de76779ac9ae16e3403df0ae55
MD5 SHA1 SHA512

Submit Download

tmp1D32.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp1D32.tmp.exe
Size 12KB
SHA256 49da3e5b0da288d896ed00e348813f9383e5beafcef19224d93145ad4477f842
MD5 860f5364a1a9e6085356fc8e90c5456e
SHA1 4e025b75b879ac727d9d78981d23e333fb198253
SHA512 364c3d4acc3a215b2fd3c7248d8ea8814c31c6d5f025e7da4285c54d137a5f84407b19bdbd721a593d67bfadb219f1fef761fb6fce8fb193886c02ccfd8cedab
SSDEEP 384:cL7li/2zXq2DcEQvdQcJKLTp/NK9xaeM:6bMCQ9ceM
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc5B5614C64E234DB1A9F3D1C43CC683FA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc5B5614C64E234DB1A9F3D1C43CC683FA.TMP
Size 1KB
SHA256 ae319d4a865d38eb12c57aaa318e0d17656f0772caf0bffdd6533764565efc26
MD5 1534ecf1c2ab95a0e565ca585082d91c
SHA1 37b4c2171bbfa086a2b35364af04c55a6a95f898
SHA512 9e6be10a0921845ecbc95c4948a6c7a4dd0b8ee8ca7dcf89a53d10518d0a6866d6363ac18f4e557c41b8ccafcb867adc0bb515f88c387cf21d756a000ee4b05f
MD5 SHA1 SHA512

Submit Download

memory/1700-0-0x000000007423E000-0x000000007423F000-memory.dmp

Download

memory/1700-1-0x00000000012B0000-0x00000000012BA000-memory.dmp

Download

memory/1700-7-0x0000000074230000-0x000000007491E000-memory.dmp

Download

memory/1700-24-0x0000000074230000-0x000000007491E000-memory.dmp

Download

memory/2664-23-0x0000000001210000-0x000000000121A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads