12f051704b66c4b350767037c4a917464c83755ccf27f8096c67b6df2ac6540c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0331158469df0cd4443f0bd7e63fbebe.exe
Size

744KB
MD5

0331158469df0cd4443f0bd7e63fbebe
SHA1

f18ae560727157cad96a3bd7a852cf7cc27454cb
SHA256

12f051704b66c4b350767037c4a917464c83755ccf27f8096c67b6df2ac6540c
SHA512

afce77e2433d166d60ae17fc31fff186606f0a9fd5d3723da298b4715203f1b8a92569610bb719a9d8fd79f7fdc34f810e0eaaa3359ba2b952341fb27afb5849
SSDEEP

12288:cR0qDrphD0iVoksPMdWo95eqW0LHmTTYUZ7FK2rxwqFpuri+MVzI0CWvfc8vy4ho:cCqDlhDBvsPIWfqBm3TrxXFpv+Mjv88Q

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4724	beddagcijb.exe

Loads dropped DLL 2 IoCs

pid	Process
544	0331158469df0cd4443f0bd7e63fbebe.exe
544	0331158469df0cd4443f0bd7e63fbebe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4072	4724	WerFault.exe	89

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	432	wmic.exe
Token: SeSecurityPrivilege	432	wmic.exe
Token: SeTakeOwnershipPrivilege	432	wmic.exe
Token: SeLoadDriverPrivilege	432	wmic.exe
Token: SeSystemProfilePrivilege	432	wmic.exe
Token: SeSystemtimePrivilege	432	wmic.exe
Token: SeProfSingleProcessPrivilege	432	wmic.exe
Token: SeIncBasePriorityPrivilege	432	wmic.exe
Token: SeCreatePagefilePrivilege	432	wmic.exe
Token: SeBackupPrivilege	432	wmic.exe
Token: SeRestorePrivilege	432	wmic.exe
Token: SeShutdownPrivilege	432	wmic.exe
Token: SeDebugPrivilege	432	wmic.exe
Token: SeSystemEnvironmentPrivilege	432	wmic.exe
Token: SeRemoteShutdownPrivilege	432	wmic.exe
Token: SeUndockPrivilege	432	wmic.exe
Token: SeManageVolumePrivilege	432	wmic.exe
Token: 33	432	wmic.exe
Token: 34	432	wmic.exe
Token: 35	432	wmic.exe
Token: 36	432	wmic.exe
Token: SeIncreaseQuotaPrivilege	432	wmic.exe
Token: SeSecurityPrivilege	432	wmic.exe
Token: SeTakeOwnershipPrivilege	432	wmic.exe
Token: SeLoadDriverPrivilege	432	wmic.exe
Token: SeSystemProfilePrivilege	432	wmic.exe
Token: SeSystemtimePrivilege	432	wmic.exe
Token: SeProfSingleProcessPrivilege	432	wmic.exe
Token: SeIncBasePriorityPrivilege	432	wmic.exe
Token: SeCreatePagefilePrivilege	432	wmic.exe
Token: SeBackupPrivilege	432	wmic.exe
Token: SeRestorePrivilege	432	wmic.exe
Token: SeShutdownPrivilege	432	wmic.exe
Token: SeDebugPrivilege	432	wmic.exe
Token: SeSystemEnvironmentPrivilege	432	wmic.exe
Token: SeRemoteShutdownPrivilege	432	wmic.exe
Token: SeUndockPrivilege	432	wmic.exe
Token: SeManageVolumePrivilege	432	wmic.exe
Token: 33	432	wmic.exe
Token: 34	432	wmic.exe
Token: 35	432	wmic.exe
Token: 36	432	wmic.exe
Token: SeIncreaseQuotaPrivilege	2044	wmic.exe
Token: SeSecurityPrivilege	2044	wmic.exe
Token: SeTakeOwnershipPrivilege	2044	wmic.exe
Token: SeLoadDriverPrivilege	2044	wmic.exe
Token: SeSystemProfilePrivilege	2044	wmic.exe
Token: SeSystemtimePrivilege	2044	wmic.exe
Token: SeProfSingleProcessPrivilege	2044	wmic.exe
Token: SeIncBasePriorityPrivilege	2044	wmic.exe
Token: SeCreatePagefilePrivilege	2044	wmic.exe
Token: SeBackupPrivilege	2044	wmic.exe
Token: SeRestorePrivilege	2044	wmic.exe
Token: SeShutdownPrivilege	2044	wmic.exe
Token: SeDebugPrivilege	2044	wmic.exe
Token: SeSystemEnvironmentPrivilege	2044	wmic.exe
Token: SeRemoteShutdownPrivilege	2044	wmic.exe
Token: SeUndockPrivilege	2044	wmic.exe
Token: SeManageVolumePrivilege	2044	wmic.exe
Token: 33	2044	wmic.exe
Token: 34	2044	wmic.exe
Token: 35	2044	wmic.exe
Token: 36	2044	wmic.exe
Token: SeIncreaseQuotaPrivilege	2044	wmic.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 4724	544	0331158469df0cd4443f0bd7e63fbebe.exe	89
PID 544 wrote to memory of 4724	544	0331158469df0cd4443f0bd7e63fbebe.exe	89
PID 544 wrote to memory of 4724	544	0331158469df0cd4443f0bd7e63fbebe.exe	89
PID 4724 wrote to memory of 432	4724	beddagcijb.exe	90
PID 4724 wrote to memory of 432	4724	beddagcijb.exe	90
PID 4724 wrote to memory of 432	4724	beddagcijb.exe	90
PID 4724 wrote to memory of 2044	4724	beddagcijb.exe	96
PID 4724 wrote to memory of 2044	4724	beddagcijb.exe	96
PID 4724 wrote to memory of 2044	4724	beddagcijb.exe	96
PID 4724 wrote to memory of 1256	4724	beddagcijb.exe	99
PID 4724 wrote to memory of 1256	4724	beddagcijb.exe	99
PID 4724 wrote to memory of 1256	4724	beddagcijb.exe	99
PID 4724 wrote to memory of 4032	4724	beddagcijb.exe	101
PID 4724 wrote to memory of 4032	4724	beddagcijb.exe	101
PID 4724 wrote to memory of 4032	4724	beddagcijb.exe	101
PID 4724 wrote to memory of 4752	4724	beddagcijb.exe	103
PID 4724 wrote to memory of 4752	4724	beddagcijb.exe	103
PID 4724 wrote to memory of 4752	4724	beddagcijb.exe	103

C:\Users\Admin\AppData\Local\Temp\0331158469df0cd4443f0bd7e63fbebe.exe
"C:\Users\Admin\AppData\Local\Temp\0331158469df0cd4443f0bd7e63fbebe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:544
- C:\Users\Admin\AppData\Local\Temp\beddagcijb.exe
  C:\Users\Admin\AppData\Local\Temp\beddagcijb.exe 1#2#8#4#9#0#9#6#4#5#1 Lk5BQDQxKiozLh8uUU0+R0k7NywbLk1DTFNGUkJDQDgvHy08RUpUQD45LTM3NS8cJkNAPjkrHy5OSks7VTpOW0RDPDErLiwgJk1BTVVEUFdRSUw0YnBvbzktJ29pdiU+QU5KLFJHTCRBR0oqRE1FTRgrOkxAPUdEQzxAci0nYl8xay1yHy08LTROTEc+QFEfLTwuNC0oGis/MjwrKRwmRCs3KSwfLkItOSQxFylMTU5DUztQVlBJQ1I8Qlg7GCtHUkY+UT5TXkNNSDg9FylMTU5DUztQVk44R0E4Hy5DUEFWVUlGORsuRFY9WzpNO0ZFSUQ8HidERlNLWT5NTlZRPU40MRcpUENATUlRS0xfTExIOB8uVEU5KSAmPk8sPB8tSlFFVEBHQVpWREo7S0RFQEc9QkRUUEQ5Fy9ATVtNVE1SQUk8PWtscWAfLlA9UExSRUNKQl5UUT1OVkQ4U084MR8tQEU7RU83LRsuSFFXQFBOOEdFPl5ETDtOUFBLP0A4ZWBqa2EXLztJU0lLTj88W0BQNC4yKTEvLiYvLi4oLjIbLlNHRUE0MSstLys2MC4tLRcvO0lTSUtOPzxbS0lEPzkwLjIvJy4nMSwkLSw5MDUyLygqOEc=
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703448856.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703448856.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703448856.txt bios get version
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703448856.txt bios get version
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703448856.txt bios get version
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 856
    3⤵
    - Program crash
    PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4724 -ip 4724
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81703448856.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703448856.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703448856.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\beddagcijb.exe

Filesize
32KB

MD5
8f131cdac31f02862e62428c67398abd

SHA1
87fb4d86b9ae5e0606cf1f0d5e094931d77ab1a9

SHA256
c162ec92361aad0bb649a6ff7099e7d43a18c16b723152eb44c6621148eaefae

SHA512
1910738a80cbc9635e583efafce985d5bce5c6dbae5a4d5f88db64292d38dc6de39791741f31c7153daab850552dae1ba9de17357d018e6fce0fce130b125db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\beddagcijb.exe

Filesize
64KB

MD5
26eeaa8134767da8de684080aa44f372

SHA1
bd84bc07a6ae7b2364589a14c41ac0740f6fdb09

SHA256
1386b29439f6a905e5ada27e964f07fb1f98135c0caa63eac473bee08d1df84b

SHA512
f8e77b0d0c0ccda294e6069a9bf1b6262a8a567040e31938dfbbd85326fc84d9febe8a5ace087365d71d049031bd4cffc69c19e8598b7f8f2077d57a8ec832f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\ZipDLL.dll

Filesize
109KB

MD5
c0303f6e1e125c4b6932bc6841c8d5a9

SHA1
67a227da5be3bc879623affd38cd10f2629b44ab

SHA256
a3572d99375c249b0532c98ee3064247022e698f46711a0b292f95dad0ddcad7

SHA512
bcdceaa252a1c2047a4a45f78a580787ea92acede6f069442e2352c580f72f97e918f9aa20327cdc2dd2b2d3f07076bee133b118ab6aee22896737ed22cdb468

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\ZipDLL.dll

Filesize
163KB

MD5
2dc35ddcabcb2b24919b9afae4ec3091

SHA1
9eeed33c3abc656353a7ebd1c66af38cccadd939

SHA256
6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

SHA512
0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\gcifgrz.dll

Filesize
83KB

MD5
a8066ac329284a3ca4a92257c5a45a08

SHA1
c4a748f0c45f3c3b40f0c77fb453571650bcee85

SHA256
3f890b2605bb5cac318db25169deb4eb5740aa798cd623c9d8cc656289f96a43

SHA512
983c4ee8b7f242a6df53ce1f09a7e98e4b3811d18a10f994ae5a28d533efe5730a68326e3cb4a13ea03fa8b99e808122e9d2c1eb204e297c05e0780743dd262b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh3E62.tmp\gcifgrz.dll

Filesize
139KB

MD5
b4c439640cfb5347cc2204975db3158a

SHA1
bcccbd1084a6f6c470c8cf1f6e9c2fd3bb5bd7a3

SHA256
e3b5210ec758da667bb2410ea33bd59f65d9310e085514548c61bc5f89af25bd

SHA512
7f10205c3de90c6a6a4a1b10ed3292e8c91c77dc5dc9e49a6ff17eaad410eaf5e520abeafd20bced012b889814e10bc63ee7910c102195b4957767fe19ff6279

Download Submit