b8ffb1799aa10698175f88696c3f2f5c438f4dc8b90ed3d50829488f49647eee

General

Target

0a500f8367b3a1c85661b7eead026340N.exe
Size

78KB
MD5

0a500f8367b3a1c85661b7eead026340
SHA1

efcf095462306e7064c4901761456d66fcdc4b8a
SHA256

b8ffb1799aa10698175f88696c3f2f5c438f4dc8b90ed3d50829488f49647eee
SHA512

9bd37f60ef9d8a1e732a70d833e3cef2616422a93639ca0eaf5d2b8d44f3d262b2a774aa1fecf7f769d34d4c42ec5ae901590e181c138ec60dabc309ddb9e395
SSDEEP

1536:EWV5jSAXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6sM9/T1uw:EWV5jS4SyRxvhTzXPvCbW2UH9/l

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2756	tmp1758.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2232	0a500f8367b3a1c85661b7eead026340N.exe
2232	0a500f8367b3a1c85661b7eead026340N.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp1758.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1758.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a500f8367b3a1c85661b7eead026340N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	0a500f8367b3a1c85661b7eead026340N.exe
Token: SeDebugPrivilege	2756	tmp1758.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2772	2232	0a500f8367b3a1c85661b7eead026340N.exe	30
PID 2232 wrote to memory of 2772	2232	0a500f8367b3a1c85661b7eead026340N.exe	30
PID 2232 wrote to memory of 2772	2232	0a500f8367b3a1c85661b7eead026340N.exe	30
PID 2232 wrote to memory of 2772	2232	0a500f8367b3a1c85661b7eead026340N.exe	30
PID 2772 wrote to memory of 2684	2772	vbc.exe	32
PID 2772 wrote to memory of 2684	2772	vbc.exe	32
PID 2772 wrote to memory of 2684	2772	vbc.exe	32
PID 2772 wrote to memory of 2684	2772	vbc.exe	32
PID 2232 wrote to memory of 2756	2232	0a500f8367b3a1c85661b7eead026340N.exe	33
PID 2232 wrote to memory of 2756	2232	0a500f8367b3a1c85661b7eead026340N.exe	33
PID 2232 wrote to memory of 2756	2232	0a500f8367b3a1c85661b7eead026340N.exe	33
PID 2232 wrote to memory of 2756	2232	0a500f8367b3a1c85661b7eead026340N.exe	33

C:\Users\Admin\AppData\Local\Temp\0a500f8367b3a1c85661b7eead026340N.exe
"C:\Users\Admin\AppData\Local\Temp\0a500f8367b3a1c85661b7eead026340N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w9b-tskj.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1814.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1813.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2684
- C:\Users\Admin\AppData\Local\Temp\tmp1758.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp1758.tmp.exe" C:\Users\Admin\AppData\Local\Temp\0a500f8367b3a1c85661b7eead026340N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES1814.tmp

Filesize
1KB

MD5
8bd0b95e28a43423f55baaa76a526dab

SHA1
bb211e0127cc603d7624d70355c772b9b40eba9d

SHA256
1a56b213002aacb0b9d48c55c6561c728e8c3d9493c772475a7e4bb1d9147cb0

SHA512
67e754e9165c46f590873cce06c1b735a7b74ee277a54798f4cf45a30b6c568d8e0c31f38a992f2a0f3f9f0f79e7580d86ea9d206fd2eccd728f0801281a5a5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1758.tmp.exe

Filesize
78KB

MD5
a2806ecb89aec90c597d016827ff8722

SHA1
efeff68b166a5fc35403a64d243c785cd6b2ac01

SHA256
e0e5f972dceaf74337da26adad1e41596e1bcd59aec01bb2b21d5554db38a9ce

SHA512
c7d2c94255faccd734ef8a476192b10a8d0ca6679bd196d1c33d2468b4f3ab0609a63f6a46e03d74d8103a98117455e1212c95aed5f47be2c268c9a4649bc600

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc1813.tmp

Filesize
660B

MD5
6e8d1a433f9c5a30488a1a7550e87575

SHA1
49b7775a1c1f1a9e8272410b773ff97daba613d1

SHA256
fb99e8245602a13d72dbe3055bc94297e88ac89b5568ea4527f1f2a4cbcff6e7

SHA512
ec1f41e72ffe65ed29d4acbcc446e4c348688e63e6b0819dd3db0d893a518556bc5c5f4eb9f02043e3adb8307e4bcbe626e44adf64f8b5c8341f502c79bd91d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\w9b-tskj.0.vb

Filesize
14KB

MD5
093fec650900982b08ec7d0442010739

SHA1
c87e86782645f47ce6c491b16e9d112a02fe8d5a

SHA256
d85fabfe923ed0bf876c9e5ca9b6edf0a5afbcdbed819f7159ba9a7a4ac82480

SHA512
abcbd741ab0c7ea5901886b2445ff388a5560d3804273aaaf79f21ffda27cde374f26a78ec860ddb5db362f40050e14061017369d352c9b2d3f106ac8f7ad015

Download Submit
C:\Users\Admin\AppData\Local\Temp\w9b-tskj.cmdline

Filesize
266B

MD5
ba1ffacaa4acd10992a998bab738382c

SHA1
ca1a019531c635a8a3df7eb9adff5b8eacd05dc9

SHA256
d2830ca557963f52e723989f20a756e8fe158491f63f844a0cf03cf7f7ec1d62

SHA512
181768dd48533bd8e42f8c30c63628389bfe2dc9592de88d03f3ed8cda39a96c81578253244570f5842262ec2ef6750282d80def863ca9dced346da5b0da99d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
8fd8e054ba10661e530e54511658ac20

SHA1
72911622012ddf68f95c1e1424894ecb4442e6fd

SHA256
822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7

SHA512
c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

Download Submit
memory/2232-0-0x0000000074C11000-0x0000000074C12000-memory.dmp

Filesize
4KB

Download
memory/2232-1-0x0000000074C10000-0x00000000751BB000-memory.dmp

Filesize
5.7MB

Download
memory/2232-2-0x0000000074C10000-0x00000000751BB000-memory.dmp

Filesize
5.7MB

Download
memory/2232-24-0x0000000074C10000-0x00000000751BB000-memory.dmp

Filesize
5.7MB

Download
memory/2772-9-0x0000000074C10000-0x00000000751BB000-memory.dmp

Filesize
5.7MB

Download
memory/2772-18-0x0000000074C10000-0x00000000751BB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads