103e110f10ddbe29f4808206106c90c6d2e95d9d461f9472cf8e4d86c54deba2

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02b199ad71fba2064099606fd526e061.exe
Size

581KB
MD5

02b199ad71fba2064099606fd526e061
SHA1

564658cf5085597f874fd1f014f62107d50e1b4e
SHA256

103e110f10ddbe29f4808206106c90c6d2e95d9d461f9472cf8e4d86c54deba2
SHA512

e20932987a314d8ddc390142d02c79550bcefe97eba66a1858bbcbc717ba192ee80516e69acfe2fc398327d9a1770d7f742e7610ee2c3621c508ef36ff1dbcd7
SSDEEP

12288:VaeH77mXp1D+EYiVbgYrbKXjM9QXbWlEk/NxiwB4dbihMqnsebyWyAo:Vak74p5+EbVCziEk/n7WdSbyWI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2916	becabffccda.exe

Loads dropped DLL 10 IoCs

pid	Process
2240	02b199ad71fba2064099606fd526e061.exe
2240	02b199ad71fba2064099606fd526e061.exe
2240	02b199ad71fba2064099606fd526e061.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	2916	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2772	wmic.exe
Token: SeSecurityPrivilege	2772	wmic.exe
Token: SeTakeOwnershipPrivilege	2772	wmic.exe
Token: SeLoadDriverPrivilege	2772	wmic.exe
Token: SeSystemProfilePrivilege	2772	wmic.exe
Token: SeSystemtimePrivilege	2772	wmic.exe
Token: SeProfSingleProcessPrivilege	2772	wmic.exe
Token: SeIncBasePriorityPrivilege	2772	wmic.exe
Token: SeCreatePagefilePrivilege	2772	wmic.exe
Token: SeBackupPrivilege	2772	wmic.exe
Token: SeRestorePrivilege	2772	wmic.exe
Token: SeShutdownPrivilege	2772	wmic.exe
Token: SeDebugPrivilege	2772	wmic.exe
Token: SeSystemEnvironmentPrivilege	2772	wmic.exe
Token: SeRemoteShutdownPrivilege	2772	wmic.exe
Token: SeUndockPrivilege	2772	wmic.exe
Token: SeManageVolumePrivilege	2772	wmic.exe
Token: 33	2772	wmic.exe
Token: 34	2772	wmic.exe
Token: 35	2772	wmic.exe
Token: SeIncreaseQuotaPrivilege	2772	wmic.exe
Token: SeSecurityPrivilege	2772	wmic.exe
Token: SeTakeOwnershipPrivilege	2772	wmic.exe
Token: SeLoadDriverPrivilege	2772	wmic.exe
Token: SeSystemProfilePrivilege	2772	wmic.exe
Token: SeSystemtimePrivilege	2772	wmic.exe
Token: SeProfSingleProcessPrivilege	2772	wmic.exe
Token: SeIncBasePriorityPrivilege	2772	wmic.exe
Token: SeCreatePagefilePrivilege	2772	wmic.exe
Token: SeBackupPrivilege	2772	wmic.exe
Token: SeRestorePrivilege	2772	wmic.exe
Token: SeShutdownPrivilege	2772	wmic.exe
Token: SeDebugPrivilege	2772	wmic.exe
Token: SeSystemEnvironmentPrivilege	2772	wmic.exe
Token: SeRemoteShutdownPrivilege	2772	wmic.exe
Token: SeUndockPrivilege	2772	wmic.exe
Token: SeManageVolumePrivilege	2772	wmic.exe
Token: 33	2772	wmic.exe
Token: 34	2772	wmic.exe
Token: 35	2772	wmic.exe
Token: SeIncreaseQuotaPrivilege	2208	wmic.exe
Token: SeSecurityPrivilege	2208	wmic.exe
Token: SeTakeOwnershipPrivilege	2208	wmic.exe
Token: SeLoadDriverPrivilege	2208	wmic.exe
Token: SeSystemProfilePrivilege	2208	wmic.exe
Token: SeSystemtimePrivilege	2208	wmic.exe
Token: SeProfSingleProcessPrivilege	2208	wmic.exe
Token: SeIncBasePriorityPrivilege	2208	wmic.exe
Token: SeCreatePagefilePrivilege	2208	wmic.exe
Token: SeBackupPrivilege	2208	wmic.exe
Token: SeRestorePrivilege	2208	wmic.exe
Token: SeShutdownPrivilege	2208	wmic.exe
Token: SeDebugPrivilege	2208	wmic.exe
Token: SeSystemEnvironmentPrivilege	2208	wmic.exe
Token: SeRemoteShutdownPrivilege	2208	wmic.exe
Token: SeUndockPrivilege	2208	wmic.exe
Token: SeManageVolumePrivilege	2208	wmic.exe
Token: 33	2208	wmic.exe
Token: 34	2208	wmic.exe
Token: 35	2208	wmic.exe
Token: SeIncreaseQuotaPrivilege	2212	wmic.exe
Token: SeSecurityPrivilege	2212	wmic.exe
Token: SeTakeOwnershipPrivilege	2212	wmic.exe
Token: SeLoadDriverPrivilege	2212	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2916	2240	02b199ad71fba2064099606fd526e061.exe	28
PID 2240 wrote to memory of 2916	2240	02b199ad71fba2064099606fd526e061.exe	28
PID 2240 wrote to memory of 2916	2240	02b199ad71fba2064099606fd526e061.exe	28
PID 2240 wrote to memory of 2916	2240	02b199ad71fba2064099606fd526e061.exe	28
PID 2916 wrote to memory of 2772	2916	becabffccda.exe	29
PID 2916 wrote to memory of 2772	2916	becabffccda.exe	29
PID 2916 wrote to memory of 2772	2916	becabffccda.exe	29
PID 2916 wrote to memory of 2772	2916	becabffccda.exe	29
PID 2916 wrote to memory of 2208	2916	becabffccda.exe	32
PID 2916 wrote to memory of 2208	2916	becabffccda.exe	32
PID 2916 wrote to memory of 2208	2916	becabffccda.exe	32
PID 2916 wrote to memory of 2208	2916	becabffccda.exe	32
PID 2916 wrote to memory of 2212	2916	becabffccda.exe	34
PID 2916 wrote to memory of 2212	2916	becabffccda.exe	34
PID 2916 wrote to memory of 2212	2916	becabffccda.exe	34
PID 2916 wrote to memory of 2212	2916	becabffccda.exe	34
PID 2916 wrote to memory of 2892	2916	becabffccda.exe	36
PID 2916 wrote to memory of 2892	2916	becabffccda.exe	36
PID 2916 wrote to memory of 2892	2916	becabffccda.exe	36
PID 2916 wrote to memory of 2892	2916	becabffccda.exe	36
PID 2916 wrote to memory of 1080	2916	becabffccda.exe	38
PID 2916 wrote to memory of 1080	2916	becabffccda.exe	38
PID 2916 wrote to memory of 1080	2916	becabffccda.exe	38
PID 2916 wrote to memory of 1080	2916	becabffccda.exe	38
PID 2916 wrote to memory of 2936	2916	becabffccda.exe	40
PID 2916 wrote to memory of 2936	2916	becabffccda.exe	40
PID 2916 wrote to memory of 2936	2916	becabffccda.exe	40
PID 2916 wrote to memory of 2936	2916	becabffccda.exe	40

C:\Users\Admin\AppData\Local\Temp\02b199ad71fba2064099606fd526e061.exe
"C:\Users\Admin\AppData\Local\Temp\02b199ad71fba2064099606fd526e061.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\becabffccda.exe
  C:\Users\Admin\AppData\Local\Temp\becabffccda.exe 8-3-8-1-0-2-1-1-1-5-0 J01BQz0wMjIfKlNNP0hIRDsvHy5JRUxUR1FLR0M8LxsvPEZLU0lCPDEzMTApHSdCSUI8Lx8qUEpMPFRDUl5IQzgxLjYsHy9RRFFVQFJXUkpLPWZzc281LydwXXF2LHNnZChhaG0lY2FyYC1oaWZnHSdCTEdCSkg/PSgtMDYxNjI3MCsxMC0sMDc2MzEwMyAnQSk8TlNMQURNLCgtMDYxNjI3MBsvPC81LDEeLkMyOC0pHSdDNDssMB8qRC06JTAgLU9RTj9VO1FXT1JHVUBCVD0YLEhRT0JUQlNaRU1JOTwgLU9RTj9VO1FXTUFLRDwfKkVQQldUUko8Hy5AWD1cO0xESkhNRDggJ0VHUlRdQVFOUlM9TzUxIC1TR0BJS1FMTV5VUEs8HypUQUo9PDEyMS8yMjAoMjAfL1RMPDEbLzxQKTwgLVFUTU9JRUJXVkVKQk5MQElFPj9EVVBLPB8qSUtcSlROUkhMRDh0anJdHy9QRFNUTU5BSz9eVVFEUV4/QVFQNTEgLUdIQ0BYNS4YLklRXkNYSUFFRjteRUxCUVhLVD1BNWVhanJkHypER1RGS08/Q15TRE09OikuNC0xLzAwKikuMjA0ODA3KTxNGCw8TldMS05AP19BTTUwNy8tODgpMS0yJjE0MQ==
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703446356.txt bios get version
    3⤵
    PID:1080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 372
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81703446356.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\becabffccda.exe

Filesize
826KB

MD5
801856b03c92517f9b6a37f27e47f975

SHA1
481d74398b73ecb2d279c34e0e2bc48f442d710a

SHA256
40b87503f6cf338d7758e9a31ae690009c16b39d42acab5da88d898b74d06c46

SHA512
fc3312d4d756e88c5677d8ab488544a9548ffdbd6180770b0a55d0e5021fffe6dfdec206af03517647315c7da6733b7ef8cfd0e65a82ffafdd16b1154cd526f6

Download Submit
\Users\Admin\AppData\Local\Temp\becabffccda.exe

Filesize
824KB

MD5
cbde8aa466e306604ef67b8f909ea665

SHA1
6cb37a37fa6a0d0b82214ef9f837b2c373bb01ee

SHA256
b76fe3f3b9dbd5efffa24b48027b51149ceb4319de989344ba239d6a7b274ff7

SHA512
96ad3ca3954546aaecf962a3931809f7b990f3618c3d9f4ff8dbc1629341467197e594f613c3ff4517ead128788fc256e566e7d50f91aa6484547cbba96dbcd7

Download Submit
\Users\Admin\AppData\Local\Temp\becabffccda.exe

Filesize
351KB

MD5
7a3ab6591d0ca712143150bbe4f1fbd4

SHA1
f583507a147d871cb822d302a07b8234c80f5fb9

SHA256
a178254af5b37a7419a397d9b15dc21280fc0f65e559787a1bddc5e9d3b75f9b

SHA512
755813f90419b18be82676a9e7cf8865c68818aa2fb47042a7b92be2c7545d6b68766038a0301bad3091877606503196cc24991a4366b25cab7bcce83c800fa7

Download Submit
\Users\Admin\AppData\Local\Temp\becabffccda.exe

Filesize
444KB

MD5
490d5f85e2ec876d19f32e0fb22e24d9

SHA1
423ecd3c6bd03280152f45d4658a1985068f50a4

SHA256
fc7866eaf8b94ce4ca0b0fdcab9385c965e8e624ba38636ddbec6ce66892362d

SHA512
ee91f6ccfd746ca897a2d26672992809e32b5218fb5b0fb28b7bd092cf4c144c34b2b64570ff984e6f3a23b0ba040d915db3b5686f593af5702d73c502d30180

Download Submit
\Users\Admin\AppData\Local\Temp\becabffccda.exe

Filesize
328KB

MD5
e55256630a0213b67431e46867c5771b

SHA1
07596578630ef0898ba93ff6f0220849266f8f76

SHA256
4209e37075de2af6fbd9a459ef9d37e332e29057b59457985f19ea1de851d6b6

SHA512
faadd19250bbbb1cabf3bdd1c643ec8604c3d243a5f853e707e6f46bc9a2a6c34d13502cca4b9845c9c6f99a1c1524b40990e6473d5367e3abe4f3aaad0d6ed9

Download Submit
\Users\Admin\AppData\Local\Temp\becabffccda.exe

Filesize
257KB

MD5
fc34310153b915db2b4ca8748f3b5c70

SHA1
416a163940ab16da1afbefff8a753ab860ce59e9

SHA256
2ff96ba60d7a28c7400ad96e1320e296267b9eab3e76139dce64f222e4141a6b

SHA512
2fc4b9c9b8b865a3ad9cc368bb2ede555091d0b781cda5a8be069696885575d52835f6428784defe4ced325b9d1f73e25345e0e1bd111ef313efc44f87de46f6

Download Submit
\Users\Admin\AppData\Local\Temp\becabffccda.exe

Filesize
234KB

MD5
62f8bf014b095b2851ac696e4b0dffee

SHA1
ad637a06c3633c29420d9d46d125f1eecac560fa

SHA256
54e7ecb0a2ed6dd19e314385e714661f5c40d32d957713d53f5b2a7b6242b93e

SHA512
a55ddd90208ced02d7496931134f865f176ab5fb7e39e77e86ea9b8e1519cf093eda9c7e93c343e0200526ecf5b804a951e80735255b196e047fd39c0a799d43

Download Submit
\Users\Admin\AppData\Local\Temp\becabffccda.exe

Filesize
261KB

MD5
f3f48b3ec45b4a83b16bda240d0ccd66

SHA1
68dd07c90712c2993af62c256aaaf05b69cdd9ce

SHA256
c426deefbfe809a5ad687e26c63d41837fdc101f7dd70b442e0c19314d16be0a

SHA512
d6085660d5c063009c1bf0f82b76de783bad032ae935bdee7c8969b04cce274fca15653fdd8d513fd32b8c462613e9a193808e918810c28d9e66df3579c03571

Download Submit
\Users\Admin\AppData\Local\Temp\nst4DB4.tmp\llff.dll

Filesize
118KB

MD5
a0950be73d1245b9c64f53491b51cccd

SHA1
2b18116ecd177fffdf977a2b1778e34aeb620684

SHA256
4a49aa14a58368f89b1d28fe384fd9fc312516faa26e26dabf744ded46308819

SHA512
689e4b5ca543f7a43d3bb48d2c0ffc8d7daa42d0c434698c6ea09af6907607e949dd74e8afce48e676bac6f461ead2506ed7208a6a5658696cbe26a41b398f1c

Download Submit
\Users\Admin\AppData\Local\Temp\nst4DB4.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit