Analysis
-
max time kernel
91s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 03:52
Static task
static1
Behavioral task
behavioral1
Sample
abf1a8f274edbb6109c894b245f7f57ff961c78a06199ec20500c5dee0530cb7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
abf1a8f274edbb6109c894b245f7f57ff961c78a06199ec20500c5dee0530cb7.exe
Resource
win10v2004-20220901-en
General
-
Target
abf1a8f274edbb6109c894b245f7f57ff961c78a06199ec20500c5dee0530cb7.exe
-
Size
339KB
-
MD5
8171d86ffe4e4f1ba363fea1aae4f03a
-
SHA1
e2abc5854e99c64c8397ed986d20ab6238af492d
-
SHA256
abf1a8f274edbb6109c894b245f7f57ff961c78a06199ec20500c5dee0530cb7
-
SHA512
c97128ca01597221530966320c694a350a05170e79e0577301fee49df4b394f5d66e696eaa2fffbe93c2e7666a68aa6dd1a38e790dcd672e241fb48ac160ab93
-
SSDEEP
6144:iFJ0x1PbKItFd8IZzj4QXLT1lrWmOwdP/Wi/PanG7vwjV:X1HCvQbDlOw9OyPaoQV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
beeifigbdh.exepid process 4740 beeifigbdh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4352 4740 WerFault.exe beeifigbdh.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 2456 wmic.exe Token: SeSecurityPrivilege 2456 wmic.exe Token: SeTakeOwnershipPrivilege 2456 wmic.exe Token: SeLoadDriverPrivilege 2456 wmic.exe Token: SeSystemProfilePrivilege 2456 wmic.exe Token: SeSystemtimePrivilege 2456 wmic.exe Token: SeProfSingleProcessPrivilege 2456 wmic.exe Token: SeIncBasePriorityPrivilege 2456 wmic.exe Token: SeCreatePagefilePrivilege 2456 wmic.exe Token: SeBackupPrivilege 2456 wmic.exe Token: SeRestorePrivilege 2456 wmic.exe Token: SeShutdownPrivilege 2456 wmic.exe Token: SeDebugPrivilege 2456 wmic.exe Token: SeSystemEnvironmentPrivilege 2456 wmic.exe Token: SeRemoteShutdownPrivilege 2456 wmic.exe Token: SeUndockPrivilege 2456 wmic.exe Token: SeManageVolumePrivilege 2456 wmic.exe Token: 33 2456 wmic.exe Token: 34 2456 wmic.exe Token: 35 2456 wmic.exe Token: 36 2456 wmic.exe Token: SeIncreaseQuotaPrivilege 2456 wmic.exe Token: SeSecurityPrivilege 2456 wmic.exe Token: SeTakeOwnershipPrivilege 2456 wmic.exe Token: SeLoadDriverPrivilege 2456 wmic.exe Token: SeSystemProfilePrivilege 2456 wmic.exe Token: SeSystemtimePrivilege 2456 wmic.exe Token: SeProfSingleProcessPrivilege 2456 wmic.exe Token: SeIncBasePriorityPrivilege 2456 wmic.exe Token: SeCreatePagefilePrivilege 2456 wmic.exe Token: SeBackupPrivilege 2456 wmic.exe Token: SeRestorePrivilege 2456 wmic.exe Token: SeShutdownPrivilege 2456 wmic.exe Token: SeDebugPrivilege 2456 wmic.exe Token: SeSystemEnvironmentPrivilege 2456 wmic.exe Token: SeRemoteShutdownPrivilege 2456 wmic.exe Token: SeUndockPrivilege 2456 wmic.exe Token: SeManageVolumePrivilege 2456 wmic.exe Token: 33 2456 wmic.exe Token: 34 2456 wmic.exe Token: 35 2456 wmic.exe Token: 36 2456 wmic.exe Token: SeIncreaseQuotaPrivilege 3236 wmic.exe Token: SeSecurityPrivilege 3236 wmic.exe Token: SeTakeOwnershipPrivilege 3236 wmic.exe Token: SeLoadDriverPrivilege 3236 wmic.exe Token: SeSystemProfilePrivilege 3236 wmic.exe Token: SeSystemtimePrivilege 3236 wmic.exe Token: SeProfSingleProcessPrivilege 3236 wmic.exe Token: SeIncBasePriorityPrivilege 3236 wmic.exe Token: SeCreatePagefilePrivilege 3236 wmic.exe Token: SeBackupPrivilege 3236 wmic.exe Token: SeRestorePrivilege 3236 wmic.exe Token: SeShutdownPrivilege 3236 wmic.exe Token: SeDebugPrivilege 3236 wmic.exe Token: SeSystemEnvironmentPrivilege 3236 wmic.exe Token: SeRemoteShutdownPrivilege 3236 wmic.exe Token: SeUndockPrivilege 3236 wmic.exe Token: SeManageVolumePrivilege 3236 wmic.exe Token: 33 3236 wmic.exe Token: 34 3236 wmic.exe Token: 35 3236 wmic.exe Token: 36 3236 wmic.exe Token: SeIncreaseQuotaPrivilege 3236 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
abf1a8f274edbb6109c894b245f7f57ff961c78a06199ec20500c5dee0530cb7.exebeeifigbdh.exedescription pid process target process PID 2680 wrote to memory of 4740 2680 abf1a8f274edbb6109c894b245f7f57ff961c78a06199ec20500c5dee0530cb7.exe beeifigbdh.exe PID 2680 wrote to memory of 4740 2680 abf1a8f274edbb6109c894b245f7f57ff961c78a06199ec20500c5dee0530cb7.exe beeifigbdh.exe PID 2680 wrote to memory of 4740 2680 abf1a8f274edbb6109c894b245f7f57ff961c78a06199ec20500c5dee0530cb7.exe beeifigbdh.exe PID 4740 wrote to memory of 2456 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 2456 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 2456 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 3236 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 3236 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 3236 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 1536 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 1536 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 1536 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 4928 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 4928 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 4928 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 3036 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 3036 4740 beeifigbdh.exe wmic.exe PID 4740 wrote to memory of 3036 4740 beeifigbdh.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abf1a8f274edbb6109c894b245f7f57ff961c78a06199ec20500c5dee0530cb7.exe"C:\Users\Admin\AppData\Local\Temp\abf1a8f274edbb6109c894b245f7f57ff961c78a06199ec20500c5dee0530cb7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\beeifigbdh.exeC:\Users\Admin\AppData\Local\Temp\beeifigbdh.exe 0]3]1]5]6]5]0]2]6]9]7 L01IPzcsOTYuKRkvUFQ9SkREOyoXKE5CU1JJTUtHPjQqICxDRE1PSUI3KTI2MTMbKT5JQjcnGS9NUUo+UENSWUA9PS83MzMzIC1NPEtWQlFaT01MO2JrbXA3LiptbXYsPjxMSypTSkooQU5KJUJOQ04bKT5MRz1CQkQ6Hyo+LD0rKxcoRC88KCsbL0ItNCYxHS4/LjgtLxomPTU6LCwaKlBQSTtOQ1FeS0xEVj89UDYgLE9NST9VQU5WPlVJQDgaKlBQSTtOQ1FeSTtIRTtfb14gLERTP1pVUEY0GS9CV0BZPk1CRkBHRTofKkJKU1JZOUtPVFJATDg1HilLQUFLSlRJUF9TTEM2ICxVSDctIC0+Sio9HS5NT0lUR0c8WFdCSz5JSEVHRzhARVJRRzcbL0dNVktVS1NER0A9cmxsXiAsUUBOUFJMQ0VAX1JSQExaRD9TSjYyHS5DQz9FVjcoGS9GUlo+VE4/R0A8X0JNPkxUUFI/OzZmXmtuXxsvQklOR0xMQD9ZRFA7LCcxLi4wKyg0MywrKSsgLE88TDxMSj9DWElLUk87R0w7bmluZR0uT0NIRTsrKy04MjgrMDEwHik7SFdLS0o7P19SQ0Q+PS4wKiwyLzAqKC4qLzksMTU0LiQ4Rg==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81669275450.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81669275450.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81669275450.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81669275450.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81669275450.txt bios get version3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 8443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4740 -ip 47401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\81669275450.txtFilesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
C:\Users\Admin\AppData\Local\Temp\81669275450.txtFilesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
C:\Users\Admin\AppData\Local\Temp\81669275450.txtFilesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
C:\Users\Admin\AppData\Local\Temp\81669275450.txtFilesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
C:\Users\Admin\AppData\Local\Temp\81669275450.txtFilesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
C:\Users\Admin\AppData\Local\Temp\beeifigbdh.exeFilesize
538KB
MD5459fe2dd1cedd2eeeca3844105cfff1f
SHA140cd4e83e6f84e980d17a67577fc74e3a0370f51
SHA25633db4a3227eec6f24e8a50503e65a05e58e284a651c5bb26e5446919e755a88f
SHA5127083bb151d4895050f38cb609cffc362e8cccbe74f00811acdba7531160ce504e0982d7afdb8146f6bdc02161a43df033ac207ea9dfcbf6171c9ac7a0f8f127d
-
C:\Users\Admin\AppData\Local\Temp\beeifigbdh.exeFilesize
538KB
MD5459fe2dd1cedd2eeeca3844105cfff1f
SHA140cd4e83e6f84e980d17a67577fc74e3a0370f51
SHA25633db4a3227eec6f24e8a50503e65a05e58e284a651c5bb26e5446919e755a88f
SHA5127083bb151d4895050f38cb609cffc362e8cccbe74f00811acdba7531160ce504e0982d7afdb8146f6bdc02161a43df033ac207ea9dfcbf6171c9ac7a0f8f127d
-
memory/1536-139-0x0000000000000000-mapping.dmp
-
memory/2456-135-0x0000000000000000-mapping.dmp
-
memory/3036-143-0x0000000000000000-mapping.dmp
-
memory/3236-137-0x0000000000000000-mapping.dmp
-
memory/4740-132-0x0000000000000000-mapping.dmp
-
memory/4928-141-0x0000000000000000-mapping.dmp