Analysis
-
max time kernel
148s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
af23fc59a3aa5ab68d7f745cd173e115f21d4411afda26e7dd7b64b0cb860c28.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
af23fc59a3aa5ab68d7f745cd173e115f21d4411afda26e7dd7b64b0cb860c28.exe
Resource
win10v2004-20221111-en
General
-
Target
af23fc59a3aa5ab68d7f745cd173e115f21d4411afda26e7dd7b64b0cb860c28.exe
-
Size
339KB
-
MD5
36013d430777cb81ec04aa3356bbc157
-
SHA1
fb047732a464ec930e265d440acf6306ec932b39
-
SHA256
af23fc59a3aa5ab68d7f745cd173e115f21d4411afda26e7dd7b64b0cb860c28
-
SHA512
ed06adbeea099cf5e4e4f553ff6326bf7df6af8d92f233ff928cce3bd03c42cd0257927d703323f2b6c18e3f35bf27a4a885a1c10178bb9a7d0514ca4eb14103
-
SSDEEP
6144:cFJ0V2AxhYwEVCehxVZW/5liWQhag0twPIkMFcBZHpUpaBYg0sABV/zcv:N2VZW/SW8ZtIkLauYP9p4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2800 beeiheibea.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1848 2800 WerFault.exe 83 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1380 wmic.exe Token: SeSecurityPrivilege 1380 wmic.exe Token: SeTakeOwnershipPrivilege 1380 wmic.exe Token: SeLoadDriverPrivilege 1380 wmic.exe Token: SeSystemProfilePrivilege 1380 wmic.exe Token: SeSystemtimePrivilege 1380 wmic.exe Token: SeProfSingleProcessPrivilege 1380 wmic.exe Token: SeIncBasePriorityPrivilege 1380 wmic.exe Token: SeCreatePagefilePrivilege 1380 wmic.exe Token: SeBackupPrivilege 1380 wmic.exe Token: SeRestorePrivilege 1380 wmic.exe Token: SeShutdownPrivilege 1380 wmic.exe Token: SeDebugPrivilege 1380 wmic.exe Token: SeSystemEnvironmentPrivilege 1380 wmic.exe Token: SeRemoteShutdownPrivilege 1380 wmic.exe Token: SeUndockPrivilege 1380 wmic.exe Token: SeManageVolumePrivilege 1380 wmic.exe Token: 33 1380 wmic.exe Token: 34 1380 wmic.exe Token: 35 1380 wmic.exe Token: 36 1380 wmic.exe Token: SeIncreaseQuotaPrivilege 1380 wmic.exe Token: SeSecurityPrivilege 1380 wmic.exe Token: SeTakeOwnershipPrivilege 1380 wmic.exe Token: SeLoadDriverPrivilege 1380 wmic.exe Token: SeSystemProfilePrivilege 1380 wmic.exe Token: SeSystemtimePrivilege 1380 wmic.exe Token: SeProfSingleProcessPrivilege 1380 wmic.exe Token: SeIncBasePriorityPrivilege 1380 wmic.exe Token: SeCreatePagefilePrivilege 1380 wmic.exe Token: SeBackupPrivilege 1380 wmic.exe Token: SeRestorePrivilege 1380 wmic.exe Token: SeShutdownPrivilege 1380 wmic.exe Token: SeDebugPrivilege 1380 wmic.exe Token: SeSystemEnvironmentPrivilege 1380 wmic.exe Token: SeRemoteShutdownPrivilege 1380 wmic.exe Token: SeUndockPrivilege 1380 wmic.exe Token: SeManageVolumePrivilege 1380 wmic.exe Token: 33 1380 wmic.exe Token: 34 1380 wmic.exe Token: 35 1380 wmic.exe Token: 36 1380 wmic.exe Token: SeIncreaseQuotaPrivilege 1764 wmic.exe Token: SeSecurityPrivilege 1764 wmic.exe Token: SeTakeOwnershipPrivilege 1764 wmic.exe Token: SeLoadDriverPrivilege 1764 wmic.exe Token: SeSystemProfilePrivilege 1764 wmic.exe Token: SeSystemtimePrivilege 1764 wmic.exe Token: SeProfSingleProcessPrivilege 1764 wmic.exe Token: SeIncBasePriorityPrivilege 1764 wmic.exe Token: SeCreatePagefilePrivilege 1764 wmic.exe Token: SeBackupPrivilege 1764 wmic.exe Token: SeRestorePrivilege 1764 wmic.exe Token: SeShutdownPrivilege 1764 wmic.exe Token: SeDebugPrivilege 1764 wmic.exe Token: SeSystemEnvironmentPrivilege 1764 wmic.exe Token: SeRemoteShutdownPrivilege 1764 wmic.exe Token: SeUndockPrivilege 1764 wmic.exe Token: SeManageVolumePrivilege 1764 wmic.exe Token: 33 1764 wmic.exe Token: 34 1764 wmic.exe Token: 35 1764 wmic.exe Token: 36 1764 wmic.exe Token: SeIncreaseQuotaPrivilege 1764 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2800 1712 af23fc59a3aa5ab68d7f745cd173e115f21d4411afda26e7dd7b64b0cb860c28.exe 83 PID 1712 wrote to memory of 2800 1712 af23fc59a3aa5ab68d7f745cd173e115f21d4411afda26e7dd7b64b0cb860c28.exe 83 PID 1712 wrote to memory of 2800 1712 af23fc59a3aa5ab68d7f745cd173e115f21d4411afda26e7dd7b64b0cb860c28.exe 83 PID 2800 wrote to memory of 1380 2800 beeiheibea.exe 85 PID 2800 wrote to memory of 1380 2800 beeiheibea.exe 85 PID 2800 wrote to memory of 1380 2800 beeiheibea.exe 85 PID 2800 wrote to memory of 1764 2800 beeiheibea.exe 87 PID 2800 wrote to memory of 1764 2800 beeiheibea.exe 87 PID 2800 wrote to memory of 1764 2800 beeiheibea.exe 87 PID 2800 wrote to memory of 2180 2800 beeiheibea.exe 89 PID 2800 wrote to memory of 2180 2800 beeiheibea.exe 89 PID 2800 wrote to memory of 2180 2800 beeiheibea.exe 89 PID 2800 wrote to memory of 1488 2800 beeiheibea.exe 91 PID 2800 wrote to memory of 1488 2800 beeiheibea.exe 91 PID 2800 wrote to memory of 1488 2800 beeiheibea.exe 91 PID 2800 wrote to memory of 3908 2800 beeiheibea.exe 93 PID 2800 wrote to memory of 3908 2800 beeiheibea.exe 93 PID 2800 wrote to memory of 3908 2800 beeiheibea.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\af23fc59a3aa5ab68d7f745cd173e115f21d4411afda26e7dd7b64b0cb860c28.exe"C:\Users\Admin\AppData\Local\Temp\af23fc59a3aa5ab68d7f745cd173e115f21d4411afda26e7dd7b64b0cb860c28.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\beeiheibea.exeC:\Users\Admin\AppData\Local\Temp\beeiheibea.exe 7|8|8|4|9|3|9|5|9|0|6 KEhBQDQvKi4pNxooS00+R0Y7OCcgKUc9TFNGT0JEOz0rGSc8RUpRQD80MjMwLigcJkBAPzQwGihISks7UjpPVkk+NioxLCctFypKRUxPPUpbTE9DOF90bmkyJytqb20pO0VNRCVMS0cqOEtHLkNHPkccJkBDRDpLQz01S29QPmFGMGxbbSw5YSdKT0UtaztHYExLWTJEP0M4L0xHakg9ZTthSGdcJmJPMkhOPzQuZjM+K0JmTEVFT2JtMEkwQWosUThmRUhtPywrZ3FkZWUoZEdCSispaj9wdU03LzxFbylsVF4vWENoMD5fUUJXQXEXLz4qNSUtFyw7LTQtKxknPC80KigbJkQuNiUpHCZBLDgkMRooSEpLO1I6T1ZQTEJOOT9QOhcqR1JJPU07UFZCTEc4PRooSEpLO1I6T1ZOO0Y9NWdaZVxuai1fZWFsYRcsPFM8X09LRDUgclJJR3QgKT5QPVs6SjtHQE4/NhgnREZQS1o5UklQSz1ONDIXKktIO0dDUUtMXExNQz1ibWxoNiYsWF5jaV1kJllgX2xaLCVuX20nbHFGdC9HLUNFcnJnUUdUSjFfb2gyZTdwazopIW1hbCo1HnJYbyk4HXZbays1Li0uLCFHQ05RNR5pNGhaY1xzbSZdZGVrYhcqTU03KxgnQEouNC0tMS8ZJ0pRRVFASDxfUT5EO0tEQkBIOEc/TkpEORcsQE5WUk9HTEFJPDprbWxlGihKPVBMT0VERUdZTks9TlZBOFRKPSwZJ0BFO0JPOCggKUJLV0BQSzhIQENZPkY7TlBNS0A7PWBaZGthFyw7Sk5ORkg5PFtATTQtJzgoKikoKjAwJSwpMhooSDlOOElDQENfQ0dLTD1DSTRvaXVfGSdMRURCNCwrNDIwLS8tLTMXKjtPUUdERz07XEtEREU3KiknLjAsKSsoNSQqKjIvKTcrMSFBRw==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670480348.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670480348.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670480348.txt bios get version3⤵PID:2180
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670480348.txt bios get version3⤵PID:1488
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81670480348.txt bios get version3⤵PID:3908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 8843⤵
- Program crash
PID:1848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2800 -ip 28001⤵PID:2192
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
538KB
MD52f54c13ef20b0d9c2437926590c07379
SHA100b05b4fe7304f3e496095837816f2d58763bd6b
SHA2563d479b7f877f62634262092d4fd855e0e5c11c7e2b90f11a986d9d40066f2bab
SHA5120b408b17e0edd586882c74325acdc905d40ebec1f13c1686f1d54fca1a00e94bb898664ced246a45866f81fb86d02b19273dd3a88ae1fac9ff32ffb61c807c17
-
Filesize
538KB
MD52f54c13ef20b0d9c2437926590c07379
SHA100b05b4fe7304f3e496095837816f2d58763bd6b
SHA2563d479b7f877f62634262092d4fd855e0e5c11c7e2b90f11a986d9d40066f2bab
SHA5120b408b17e0edd586882c74325acdc905d40ebec1f13c1686f1d54fca1a00e94bb898664ced246a45866f81fb86d02b19273dd3a88ae1fac9ff32ffb61c807c17