6f8164ef913d021af0766b111ab0fe1790f6d87568d2ec2aad75c6797c0b6ddd

Analysis

max time kernel
66s
max time network
58s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09/01/2023, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e9be246e37eceffedcf036d5bce39e9.exe
Size 5.9MB
Sample230109-ancbssfb55
SHA256 6f8164ef913d021af0766b111ab0fe1790f6d87568d2ec2aad75c6797c0b6ddd
MD5 0e9be246e37eceffedcf036d5bce39e9
SHA1 f312a3ea84511be2512692384f7611f1c128ffe9
SHA512 531a08e4614a01a367c7ca6704f8589558157d6c615657e8a510dca09756ae5ff3a008a06f803d1cb00c3db6aecc6c2d0d840de244d50d1ef74ba9aa51c6332c
SSDEEP 49152:zYTbKuW0rl+W1iKKsmBwIFCqg4Xr3H6gWPKBnpuhpFqo3m1lnQwOXOZOJSmSMqWq:6+G7z5sqGMv79Ce6Q+K8g/rWlVkTh
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1864	loader.pif

Loads dropped DLL 4 IoCs

pid	Process
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
816	1864	WerFault.exe	34

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
112	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	1864	loader.pif

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1868	364	0e9be246e37eceffedcf036d5bce39e9.exe	28
PID 364 wrote to memory of 1868	364	0e9be246e37eceffedcf036d5bce39e9.exe	28
PID 364 wrote to memory of 1868	364	0e9be246e37eceffedcf036d5bce39e9.exe	28
PID 1868 wrote to memory of 112	1868	cmd.exe	30
PID 1868 wrote to memory of 112	1868	cmd.exe	30
PID 1868 wrote to memory of 112	1868	cmd.exe	30
PID 364 wrote to memory of 1756	364	0e9be246e37eceffedcf036d5bce39e9.exe	31
PID 364 wrote to memory of 1756	364	0e9be246e37eceffedcf036d5bce39e9.exe	31
PID 364 wrote to memory of 1756	364	0e9be246e37eceffedcf036d5bce39e9.exe	31
PID 1756 wrote to memory of 1268	1756	cmd.exe	33
PID 1756 wrote to memory of 1268	1756	cmd.exe	33
PID 1756 wrote to memory of 1268	1756	cmd.exe	33
PID 1268 wrote to memory of 1864	1268	powershell.exe	34
PID 1268 wrote to memory of 1864	1268	powershell.exe	34
PID 1268 wrote to memory of 1864	1268	powershell.exe	34
PID 1268 wrote to memory of 1864	1268	powershell.exe	34
PID 1864 wrote to memory of 816	1864	loader.pif	35
PID 1864 wrote to memory of 816	1864	loader.pif	35
PID 1864 wrote to memory of 816	1864	loader.pif	35
PID 1864 wrote to memory of 816	1864	loader.pif	35

C:\Users\Admin\AppData\Local\Temp\0e9be246e37eceffedcf036d5bce39e9.exe
"C:\Users\Admin\AppData\Local\Temp\0e9be246e37eceffedcf036d5bce39e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C "powershell -w Hidden -ExecutionPolicy Bypass -C Set-MpPreference -ExclusionPath C:\\"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w Hidden -ExecutionPolicy Bypass -C Set-MpPreference -ExclusionPath C:\\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:112
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C "powershell -w Hidden -ExecutionPolicy Bypass -c Start-Process C:\ProgramData\loader.pif"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w Hidden -ExecutionPolicy Bypass -c Start-Process C:\ProgramData\loader.pif
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\ProgramData\loader.pif
      "C:\ProgramData\loader.pif"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1088
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

loader.pif

Path C:\ProgramData\loader.pif
Size 7KB
SHA256 8ee570b28eed3b7435202b0a91ecf2a41956d2c06a90745501007a0119617756
MD5 59b8ce54fef9fac5fae5f5e55978a0ff
SHA1 f5967e47d8b8c23ebf29a8889996d2cfa0bdac46
SHA512 66916fe1a69a42fb9e03528c1aa9a36694cc0f35385c5bc77698c75d2b428b6eda70771b4447a72a94ea21a7f5123fb0ff47a0772588d5c487f104898d7f20aa
SSDEEP 96:1EP7fcigNdGwd2JMjZjVBP8uO6kyj+ZVzHxzNt:SP7fYSm1VBkuOHyj+ZxHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.pif

Path C:\ProgramData\loader.pif
Size 7KB
SHA256 8ee570b28eed3b7435202b0a91ecf2a41956d2c06a90745501007a0119617756
MD5 59b8ce54fef9fac5fae5f5e55978a0ff
SHA1 f5967e47d8b8c23ebf29a8889996d2cfa0bdac46
SHA512 66916fe1a69a42fb9e03528c1aa9a36694cc0f35385c5bc77698c75d2b428b6eda70771b4447a72a94ea21a7f5123fb0ff47a0772588d5c487f104898d7f20aa
SSDEEP 96:1EP7fcigNdGwd2JMjZjVBP8uO6kyj+ZVzHxzNt:SP7fYSm1VBkuOHyj+ZxHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 4689ebeebae8c6df91105ba134d99ab5c66b31b95d3d44502eaea50f1ce8b22d
MD5 a7f85860a89fced19eab8fe69a0b0aea
SHA1 06992d2426f510f74545a3aa86bcfe252dab540a
SHA512 1d8de778202b03798eeb673dfcc80a4e9fa67018f5cbd4945f7c2385fa4c4cfc3191bdd6e5d8fa7fb3e523513531679face06a85cc6b220199852940e6556534
SSDEEP 192:8XOUoIj8cXOAHnorKj8A0kUa7t3ByTNT5:8XOUfj8cXOAHGKj8A0kBt3ByTNT5
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.pif

Path \ProgramData\loader.pif
Size 7KB
SHA256 8ee570b28eed3b7435202b0a91ecf2a41956d2c06a90745501007a0119617756
MD5 59b8ce54fef9fac5fae5f5e55978a0ff
SHA1 f5967e47d8b8c23ebf29a8889996d2cfa0bdac46
SHA512 66916fe1a69a42fb9e03528c1aa9a36694cc0f35385c5bc77698c75d2b428b6eda70771b4447a72a94ea21a7f5123fb0ff47a0772588d5c487f104898d7f20aa
SSDEEP 96:1EP7fcigNdGwd2JMjZjVBP8uO6kyj+ZVzHxzNt:SP7fYSm1VBkuOHyj+ZxHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.pif

Path \ProgramData\loader.pif
Size 7KB
SHA256 8ee570b28eed3b7435202b0a91ecf2a41956d2c06a90745501007a0119617756
MD5 59b8ce54fef9fac5fae5f5e55978a0ff
SHA1 f5967e47d8b8c23ebf29a8889996d2cfa0bdac46
SHA512 66916fe1a69a42fb9e03528c1aa9a36694cc0f35385c5bc77698c75d2b428b6eda70771b4447a72a94ea21a7f5123fb0ff47a0772588d5c487f104898d7f20aa
SSDEEP 96:1EP7fcigNdGwd2JMjZjVBP8uO6kyj+ZVzHxzNt:SP7fYSm1VBkuOHyj+ZxHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.pif

Path \ProgramData\loader.pif
Size 7KB
SHA256 8ee570b28eed3b7435202b0a91ecf2a41956d2c06a90745501007a0119617756
MD5 59b8ce54fef9fac5fae5f5e55978a0ff
SHA1 f5967e47d8b8c23ebf29a8889996d2cfa0bdac46
SHA512 66916fe1a69a42fb9e03528c1aa9a36694cc0f35385c5bc77698c75d2b428b6eda70771b4447a72a94ea21a7f5123fb0ff47a0772588d5c487f104898d7f20aa
SSDEEP 96:1EP7fcigNdGwd2JMjZjVBP8uO6kyj+ZVzHxzNt:SP7fYSm1VBkuOHyj+ZxHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.pif

Path \ProgramData\loader.pif
Size 7KB
SHA256 8ee570b28eed3b7435202b0a91ecf2a41956d2c06a90745501007a0119617756
MD5 59b8ce54fef9fac5fae5f5e55978a0ff
SHA1 f5967e47d8b8c23ebf29a8889996d2cfa0bdac46
SHA512 66916fe1a69a42fb9e03528c1aa9a36694cc0f35385c5bc77698c75d2b428b6eda70771b4447a72a94ea21a7f5123fb0ff47a0772588d5c487f104898d7f20aa
SSDEEP 96:1EP7fcigNdGwd2JMjZjVBP8uO6kyj+ZVzHxzNt:SP7fYSm1VBkuOHyj+ZxHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-57-0x000007FEF3600000-0x000007FEF4023000-memory.dmp

Download

memory/112-60-0x000000001B780000-0x000000001BA7F000-memory.dmp

Download

memory/112-58-0x000007FEF2AA0000-0x000007FEF35FD000-memory.dmp

Download

memory/112-59-0x0000000002510000-0x0000000002590000-memory.dmp

Download

memory/112-56-0x000007FEFB941000-0x000007FEFB943000-memory.dmp

Download

memory/1268-67-0x0000000002764000-0x0000000002767000-memory.dmp

Download

memory/1268-71-0x0000000002764000-0x0000000002767000-memory.dmp

Download

memory/1268-72-0x000000000276B000-0x000000000278A000-memory.dmp

Download

memory/1268-66-0x000007FEF2100000-0x000007FEF2C5D000-memory.dmp

Download

memory/1268-65-0x000007FEF2C60000-0x000007FEF3683000-memory.dmp

Download

memory/1864-73-0x00000000013E0000-0x00000000013E8000-memory.dmp

Download

memory/1864-74-0x00000000757E1000-0x00000000757E3000-memory.dmp

Download