Analysis
-
max time kernel
63s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
24-08-2023 06:12
Behavioral task
behavioral1
Sample
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe
-
Size
10.7MB
-
MD5
55e01ccde663350f90205c74a706ae81
-
SHA1
2f2c95f12d3cb3eaa1bcbf79ea1bfebad0e9051b
-
SHA256
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025
-
SHA512
d8fc0de1a3b69719e2b4377c159c5d71d1d32b1a13ea65aa5061c8171b3a94d3a79279f8188440c14112568b70cd1d98ba9b6132c272e0c89ba7cbb281db6b46
-
SSDEEP
98304:4R2ST6gbhYU35sX8LAVy4KEIhfdYOPzZTiNT:4R7nhY+5vLAVy4XPOPzaT
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_Classes\Local Settings rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe Token: SeIncreaseQuotaPrivilege 2404 wmic.exe Token: SeSecurityPrivilege 2404 wmic.exe Token: SeTakeOwnershipPrivilege 2404 wmic.exe Token: SeLoadDriverPrivilege 2404 wmic.exe Token: SeSystemProfilePrivilege 2404 wmic.exe Token: SeSystemtimePrivilege 2404 wmic.exe Token: SeProfSingleProcessPrivilege 2404 wmic.exe Token: SeIncBasePriorityPrivilege 2404 wmic.exe Token: SeCreatePagefilePrivilege 2404 wmic.exe Token: SeBackupPrivilege 2404 wmic.exe Token: SeRestorePrivilege 2404 wmic.exe Token: SeShutdownPrivilege 2404 wmic.exe Token: SeDebugPrivilege 2404 wmic.exe Token: SeSystemEnvironmentPrivilege 2404 wmic.exe Token: SeRemoteShutdownPrivilege 2404 wmic.exe Token: SeUndockPrivilege 2404 wmic.exe Token: SeManageVolumePrivilege 2404 wmic.exe Token: 33 2404 wmic.exe Token: 34 2404 wmic.exe Token: 35 2404 wmic.exe Token: SeIncreaseQuotaPrivilege 2404 wmic.exe Token: SeSecurityPrivilege 2404 wmic.exe Token: SeTakeOwnershipPrivilege 2404 wmic.exe Token: SeLoadDriverPrivilege 2404 wmic.exe Token: SeSystemProfilePrivilege 2404 wmic.exe Token: SeSystemtimePrivilege 2404 wmic.exe Token: SeProfSingleProcessPrivilege 2404 wmic.exe Token: SeIncBasePriorityPrivilege 2404 wmic.exe Token: SeCreatePagefilePrivilege 2404 wmic.exe Token: SeBackupPrivilege 2404 wmic.exe Token: SeRestorePrivilege 2404 wmic.exe Token: SeShutdownPrivilege 2404 wmic.exe Token: SeDebugPrivilege 2404 wmic.exe Token: SeSystemEnvironmentPrivilege 2404 wmic.exe Token: SeRemoteShutdownPrivilege 2404 wmic.exe Token: SeUndockPrivilege 2404 wmic.exe Token: SeManageVolumePrivilege 2404 wmic.exe Token: 33 2404 wmic.exe Token: 34 2404 wmic.exe Token: 35 2404 wmic.exe Token: SeIncreaseQuotaPrivilege 3044 wmic.exe Token: SeSecurityPrivilege 3044 wmic.exe Token: SeTakeOwnershipPrivilege 3044 wmic.exe Token: SeLoadDriverPrivilege 3044 wmic.exe Token: SeSystemProfilePrivilege 3044 wmic.exe Token: SeSystemtimePrivilege 3044 wmic.exe Token: SeProfSingleProcessPrivilege 3044 wmic.exe Token: SeIncBasePriorityPrivilege 3044 wmic.exe Token: SeCreatePagefilePrivilege 3044 wmic.exe Token: SeBackupPrivilege 3044 wmic.exe Token: SeRestorePrivilege 3044 wmic.exe Token: SeShutdownPrivilege 3044 wmic.exe Token: SeDebugPrivilege 3044 wmic.exe Token: SeSystemEnvironmentPrivilege 3044 wmic.exe Token: SeRemoteShutdownPrivilege 3044 wmic.exe Token: SeUndockPrivilege 3044 wmic.exe Token: SeManageVolumePrivilege 3044 wmic.exe Token: 33 3044 wmic.exe Token: 34 3044 wmic.exe Token: 35 3044 wmic.exe Token: SeIncreaseQuotaPrivilege 3044 wmic.exe Token: SeSecurityPrivilege 3044 wmic.exe Token: SeTakeOwnershipPrivilege 3044 wmic.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2404 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 29 PID 2316 wrote to memory of 2404 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 29 PID 2316 wrote to memory of 2404 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 29 PID 2316 wrote to memory of 3044 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 31 PID 2316 wrote to memory of 3044 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 31 PID 2316 wrote to memory of 3044 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 31 PID 2316 wrote to memory of 2904 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 32 PID 2316 wrote to memory of 2904 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 32 PID 2316 wrote to memory of 2904 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 32 PID 2316 wrote to memory of 2908 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 33 PID 2316 wrote to memory of 2908 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 33 PID 2316 wrote to memory of 2908 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 33 PID 2316 wrote to memory of 2796 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 34 PID 2316 wrote to memory of 2796 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 34 PID 2316 wrote to memory of 2796 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 34 PID 2316 wrote to memory of 2740 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 35 PID 2316 wrote to memory of 2740 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 35 PID 2316 wrote to memory of 2740 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 35 PID 2316 wrote to memory of 2708 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 36 PID 2316 wrote to memory of 2708 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 36 PID 2316 wrote to memory of 2708 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 36 PID 2316 wrote to memory of 2768 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 37 PID 2316 wrote to memory of 2768 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 37 PID 2316 wrote to memory of 2768 2316 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe"C:\Users\Admin\AppData\Local\Temp\b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:2904
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:2908
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:2796
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:2740
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:2708
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:2768
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\UninstallConvertTo.shtml1⤵
- Modifies registry class
PID:708