dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf

General

Target

dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe
Size

799KB
MD5

fe56f5cd5809ee68de8a6e318502e5bc
SHA1

aa28424ce61bb9bf21198a69f23389adac7adeef
SHA256

dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf
SHA512

5122896591eee01f5cbc52af709e64de068431622a4c835d1b69e2453898b05a93b23dee90d0614ebb9e3bb21b0b21e5851d009823fc4128d1ef8656a3e68b01
SSDEEP

6144:Dz1xOecgEnOxUwWz1w4mcH+dZvF4lBFusBQncK67MgRXXRpzAMCkhoGZzHEbikXe:31seJzWz1l+LI6ws4z9HEbi1F

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2200-0-0x00000000000F0000-0x0000000000187000-memory.dmp	upx
behavioral1/memory/2200-18-0x00000000000F0000-0x0000000000187000-memory.dmp	upx
behavioral1/memory/2200-27-0x00000000000F0000-0x0000000000187000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsShell140503.log	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe
File opened for modification	C:\Windows\WindowSystemNewUpdate52.log	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2344	2024	WerFault.exe	27
1768	2456	WerFault.exe	29

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	convert.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe
Token: SeDebugPrivilege	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe
Token: SeIncBasePriorityPrivilege	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2024	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	27
PID 2200 wrote to memory of 2024	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	27
PID 2200 wrote to memory of 2024	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	27
PID 2200 wrote to memory of 2024	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	27
PID 2200 wrote to memory of 2024	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	27
PID 2200 wrote to memory of 2024	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	27
PID 2200 wrote to memory of 2024	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	27
PID 2024 wrote to memory of 2344	2024	regedt32.exe	28
PID 2024 wrote to memory of 2344	2024	regedt32.exe	28
PID 2024 wrote to memory of 2344	2024	regedt32.exe	28
PID 2024 wrote to memory of 2344	2024	regedt32.exe	28
PID 2200 wrote to memory of 2456	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	29
PID 2200 wrote to memory of 2456	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	29
PID 2200 wrote to memory of 2456	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	29
PID 2200 wrote to memory of 2456	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	29
PID 2200 wrote to memory of 2456	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	29
PID 2200 wrote to memory of 2456	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	29
PID 2200 wrote to memory of 2456	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	29
PID 2456 wrote to memory of 1768	2456	convert.exe	31
PID 2456 wrote to memory of 1768	2456	convert.exe	31
PID 2456 wrote to memory of 1768	2456	convert.exe	31
PID 2456 wrote to memory of 1768	2456	convert.exe	31
PID 2200 wrote to memory of 3008	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	32
PID 2200 wrote to memory of 3008	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	32
PID 2200 wrote to memory of 3008	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	32
PID 2200 wrote to memory of 3008	2200	dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe	32

C:\Users\Admin\AppData\Local\Temp\dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe
"C:\Users\Admin\AppData\Local\Temp\dbf83dee807c235bedaefa9ab0a2cec1bc5d7f7dd447f480b00a58ba4e0fbfcf.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\regedt32.exe
  "C:\Windows\SysWOW64\regedt32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 120
    3⤵
    - Program crash
    PID:2344
- C:\Windows\SysWOW64\convert.exe
  "C:\Windows\SysWOW64\convert.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 176
    3⤵
    - Program crash
    PID:1768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DBF83D~1.EXE > nul
  2⤵
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-2-0x0000000000080000-0x00000000000E7000-memory.dmp

Filesize
412KB

Download
memory/2024-4-0x0000000000080000-0x00000000000E7000-memory.dmp

Filesize
412KB

Download
memory/2024-6-0x0000000000080000-0x00000000000E7000-memory.dmp

Filesize
412KB

Download
memory/2024-8-0x0000000000080000-0x00000000000E7000-memory.dmp

Filesize
412KB

Download
memory/2200-0-0x00000000000F0000-0x0000000000187000-memory.dmp

Filesize
604KB

Download
memory/2200-18-0x00000000000F0000-0x0000000000187000-memory.dmp

Filesize
604KB

Download
memory/2200-19-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download
memory/2200-27-0x00000000000F0000-0x0000000000187000-memory.dmp

Filesize
604KB

Download
memory/2200-43-0x00000000040C0000-0x0000000004426000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing