Analysis
-
max time kernel
164s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 08:29
Static task
static1
Behavioral task
behavioral1
Sample
ab92bd3c8be3a9a072e58328da40451602c5527a49a889c0d06549f04323e0c6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab92bd3c8be3a9a072e58328da40451602c5527a49a889c0d06549f04323e0c6.exe
Resource
win10v2004-20220812-en
General
-
Target
ab92bd3c8be3a9a072e58328da40451602c5527a49a889c0d06549f04323e0c6.exe
-
Size
372KB
-
MD5
4d57ef6df8220be5e468468ffbc1cfbe
-
SHA1
adca6167e344eba38708b3bef4120c64959ceea9
-
SHA256
ab92bd3c8be3a9a072e58328da40451602c5527a49a889c0d06549f04323e0c6
-
SHA512
f2e90d2e177ba3c8a6874ddae3f9ef4dc50452d2bc95ccb08fc341b87548dc49835c90a811d54a0dbea8ba22dab7bcc133323bad0543f8f71678bc72122dd483
-
SSDEEP
6144:VFJ0BX7ETZJj9Nc/iPudw+9SpEFjVJG1BRtpLW0HYHWYenwpmACjrKU+6mzDR+kn:8XWJpNNYLXQfj4HFenwhirKJo51C
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3232 beejcjiiid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 224 3232 WerFault.exe 80 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2336 wmic.exe Token: SeSecurityPrivilege 2336 wmic.exe Token: SeTakeOwnershipPrivilege 2336 wmic.exe Token: SeLoadDriverPrivilege 2336 wmic.exe Token: SeSystemProfilePrivilege 2336 wmic.exe Token: SeSystemtimePrivilege 2336 wmic.exe Token: SeProfSingleProcessPrivilege 2336 wmic.exe Token: SeIncBasePriorityPrivilege 2336 wmic.exe Token: SeCreatePagefilePrivilege 2336 wmic.exe Token: SeBackupPrivilege 2336 wmic.exe Token: SeRestorePrivilege 2336 wmic.exe Token: SeShutdownPrivilege 2336 wmic.exe Token: SeDebugPrivilege 2336 wmic.exe Token: SeSystemEnvironmentPrivilege 2336 wmic.exe Token: SeRemoteShutdownPrivilege 2336 wmic.exe Token: SeUndockPrivilege 2336 wmic.exe Token: SeManageVolumePrivilege 2336 wmic.exe Token: 33 2336 wmic.exe Token: 34 2336 wmic.exe Token: 35 2336 wmic.exe Token: 36 2336 wmic.exe Token: SeIncreaseQuotaPrivilege 2336 wmic.exe Token: SeSecurityPrivilege 2336 wmic.exe Token: SeTakeOwnershipPrivilege 2336 wmic.exe Token: SeLoadDriverPrivilege 2336 wmic.exe Token: SeSystemProfilePrivilege 2336 wmic.exe Token: SeSystemtimePrivilege 2336 wmic.exe Token: SeProfSingleProcessPrivilege 2336 wmic.exe Token: SeIncBasePriorityPrivilege 2336 wmic.exe Token: SeCreatePagefilePrivilege 2336 wmic.exe Token: SeBackupPrivilege 2336 wmic.exe Token: SeRestorePrivilege 2336 wmic.exe Token: SeShutdownPrivilege 2336 wmic.exe Token: SeDebugPrivilege 2336 wmic.exe Token: SeSystemEnvironmentPrivilege 2336 wmic.exe Token: SeRemoteShutdownPrivilege 2336 wmic.exe Token: SeUndockPrivilege 2336 wmic.exe Token: SeManageVolumePrivilege 2336 wmic.exe Token: 33 2336 wmic.exe Token: 34 2336 wmic.exe Token: 35 2336 wmic.exe Token: 36 2336 wmic.exe Token: SeIncreaseQuotaPrivilege 4280 wmic.exe Token: SeSecurityPrivilege 4280 wmic.exe Token: SeTakeOwnershipPrivilege 4280 wmic.exe Token: SeLoadDriverPrivilege 4280 wmic.exe Token: SeSystemProfilePrivilege 4280 wmic.exe Token: SeSystemtimePrivilege 4280 wmic.exe Token: SeProfSingleProcessPrivilege 4280 wmic.exe Token: SeIncBasePriorityPrivilege 4280 wmic.exe Token: SeCreatePagefilePrivilege 4280 wmic.exe Token: SeBackupPrivilege 4280 wmic.exe Token: SeRestorePrivilege 4280 wmic.exe Token: SeShutdownPrivilege 4280 wmic.exe Token: SeDebugPrivilege 4280 wmic.exe Token: SeSystemEnvironmentPrivilege 4280 wmic.exe Token: SeRemoteShutdownPrivilege 4280 wmic.exe Token: SeUndockPrivilege 4280 wmic.exe Token: SeManageVolumePrivilege 4280 wmic.exe Token: 33 4280 wmic.exe Token: 34 4280 wmic.exe Token: 35 4280 wmic.exe Token: 36 4280 wmic.exe Token: SeIncreaseQuotaPrivilege 4280 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1280 wrote to memory of 3232 1280 ab92bd3c8be3a9a072e58328da40451602c5527a49a889c0d06549f04323e0c6.exe 80 PID 1280 wrote to memory of 3232 1280 ab92bd3c8be3a9a072e58328da40451602c5527a49a889c0d06549f04323e0c6.exe 80 PID 1280 wrote to memory of 3232 1280 ab92bd3c8be3a9a072e58328da40451602c5527a49a889c0d06549f04323e0c6.exe 80 PID 3232 wrote to memory of 2336 3232 beejcjiiid.exe 81 PID 3232 wrote to memory of 2336 3232 beejcjiiid.exe 81 PID 3232 wrote to memory of 2336 3232 beejcjiiid.exe 81 PID 3232 wrote to memory of 4280 3232 beejcjiiid.exe 84 PID 3232 wrote to memory of 4280 3232 beejcjiiid.exe 84 PID 3232 wrote to memory of 4280 3232 beejcjiiid.exe 84 PID 3232 wrote to memory of 684 3232 beejcjiiid.exe 86 PID 3232 wrote to memory of 684 3232 beejcjiiid.exe 86 PID 3232 wrote to memory of 684 3232 beejcjiiid.exe 86 PID 3232 wrote to memory of 3300 3232 beejcjiiid.exe 88 PID 3232 wrote to memory of 3300 3232 beejcjiiid.exe 88 PID 3232 wrote to memory of 3300 3232 beejcjiiid.exe 88 PID 3232 wrote to memory of 3084 3232 beejcjiiid.exe 90 PID 3232 wrote to memory of 3084 3232 beejcjiiid.exe 90 PID 3232 wrote to memory of 3084 3232 beejcjiiid.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab92bd3c8be3a9a072e58328da40451602c5527a49a889c0d06549f04323e0c6.exe"C:\Users\Admin\AppData\Local\Temp\ab92bd3c8be3a9a072e58328da40451602c5527a49a889c0d06549f04323e0c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\beejcjiiid.exeC:\Users\Admin\AppData\Local\Temp\beejcjiiid.exe 9)1)6)4)4)3)8)5)6)2)1 Jk9DQDkuMTMuMB8mUk8+TEY8OCoeLkVETlNLT0NEPjsvFy4+RU9RQT83Lh8mQkNAOS0YKkpQTjtUPVBbRjw4Kh4uSkRMUkFPV1BMSjxfc25sNiwnbmx0LTtETUcpUUdLJz9PRy1DSkJMGCo9Skg6SkNAOR0nPys7LCgfKUAuOiUsGi1DKjwnLRwsPC83KzAXLj4xOSopGylOUUZDTz9QXEhNQ1RAOlg3HCtNSko+U0JLXj9RSD41GylOUUZDTz9QXEY8R0M8Fy4/VEFcTU1GOx8mRFJBW0BFP0ZHTTw8GitETEtPWUBRRlZNQU46LRspUkc4TUVVS1JXUExKPBcuUEk5LxgqPlEwNB8pTlFLTERHQ15OREY/S0o9REc/RjxUTEg5HSdETV1RTE1ORUlCNW9sc2QXLkxBUFJKSUNMRlZUTUFOXDw8U1E8KR8pREVBPVM3Lx8mSE1bQFZGPEdHQlZESD9OVkhPP0I8XWBmb2EdJz9JVU1DTjtAW0ZIOCwuNyUwKywqNispKzAxFy5KPU4+REc/Sl5ATU1QPUlEOG5wdFwfKVBFSj04KzIzMDIrLTE1MRspQk5OTUZLPUFXT0NLRDQwLCsxLCorKzMpKC80Ly83KDQkP0w=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81667858440.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81667858440.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81667858440.txt bios get version3⤵PID:684
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81667858440.txt bios get version3⤵PID:3300
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81667858440.txt bios get version3⤵PID:3084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 8563⤵
- Program crash
PID:224
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3232 -ip 32321⤵PID:3812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
635KB
MD5f3c5b466490eea2775a688e93dcdec75
SHA1066f53580f07dacac692520dcd501eab8d10b8c2
SHA25617bf348d9c4908f14e0ad579c657a96cbb6468a31ed3b84e61dee829271d7222
SHA51216effa12110d91a41101a7aadd8b94d93c2fa4b9e85fadd5f370b2955af6d48e5065b533bcac01d36c9dc90b31a0ffc90860b53bd44425d8b7ace73b68ce757f
-
Filesize
635KB
MD5f3c5b466490eea2775a688e93dcdec75
SHA1066f53580f07dacac692520dcd501eab8d10b8c2
SHA25617bf348d9c4908f14e0ad579c657a96cbb6468a31ed3b84e61dee829271d7222
SHA51216effa12110d91a41101a7aadd8b94d93c2fa4b9e85fadd5f370b2955af6d48e5065b533bcac01d36c9dc90b31a0ffc90860b53bd44425d8b7ace73b68ce757f