8a379a4e3c2c7d4165b20b961af2a6799b89a9d729a31cecc324c7ad2bb2d54d

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d8bd0abfe9c448f8b3f08c8c181390.exe
Size

581KB
MD5

04d8bd0abfe9c448f8b3f08c8c181390
SHA1

00b40dd8d27ec3403d2cd5d588b7808eedd89579
SHA256

8a379a4e3c2c7d4165b20b961af2a6799b89a9d729a31cecc324c7ad2bb2d54d
SHA512

1933deb59010f4cf685ed78300923631e0a5cc34ca99ebf69e8eb8286b4774cdf0e4ee598b7ef7866d6620a8d7ca36733ebdb259972c09e85995ef869ec301a3
SSDEEP

12288:+TDJhNH8ZkXWykEr8369tNFMP8NdHXpZ2achJC4+Q:+PJbl+36tKPdhJ7d

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2592	1431831751.exe

Loads dropped DLL 2 IoCs

pid	Process
4704	04d8bd0abfe9c448f8b3f08c8c181390.exe
4704	04d8bd0abfe9c448f8b3f08c8c181390.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4124	2592	WerFault.exe	21

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1276	wmic.exe
Token: SeSecurityPrivilege	1276	wmic.exe
Token: SeTakeOwnershipPrivilege	1276	wmic.exe
Token: SeLoadDriverPrivilege	1276	wmic.exe
Token: SeSystemProfilePrivilege	1276	wmic.exe
Token: SeSystemtimePrivilege	1276	wmic.exe
Token: SeProfSingleProcessPrivilege	1276	wmic.exe
Token: SeIncBasePriorityPrivilege	1276	wmic.exe
Token: SeCreatePagefilePrivilege	1276	wmic.exe
Token: SeBackupPrivilege	1276	wmic.exe
Token: SeRestorePrivilege	1276	wmic.exe
Token: SeShutdownPrivilege	1276	wmic.exe
Token: SeDebugPrivilege	1276	wmic.exe
Token: SeSystemEnvironmentPrivilege	1276	wmic.exe
Token: SeRemoteShutdownPrivilege	1276	wmic.exe
Token: SeUndockPrivilege	1276	wmic.exe
Token: SeManageVolumePrivilege	1276	wmic.exe
Token: 33	1276	wmic.exe
Token: 34	1276	wmic.exe
Token: 35	1276	wmic.exe
Token: 36	1276	wmic.exe
Token: SeIncreaseQuotaPrivilege	1276	wmic.exe
Token: SeSecurityPrivilege	1276	wmic.exe
Token: SeTakeOwnershipPrivilege	1276	wmic.exe
Token: SeLoadDriverPrivilege	1276	wmic.exe
Token: SeSystemProfilePrivilege	1276	wmic.exe
Token: SeSystemtimePrivilege	1276	wmic.exe
Token: SeProfSingleProcessPrivilege	1276	wmic.exe
Token: SeIncBasePriorityPrivilege	1276	wmic.exe
Token: SeCreatePagefilePrivilege	1276	wmic.exe
Token: SeBackupPrivilege	1276	wmic.exe
Token: SeRestorePrivilege	1276	wmic.exe
Token: SeShutdownPrivilege	1276	wmic.exe
Token: SeDebugPrivilege	1276	wmic.exe
Token: SeSystemEnvironmentPrivilege	1276	wmic.exe
Token: SeRemoteShutdownPrivilege	1276	wmic.exe
Token: SeUndockPrivilege	1276	wmic.exe
Token: SeManageVolumePrivilege	1276	wmic.exe
Token: 33	1276	wmic.exe
Token: 34	1276	wmic.exe
Token: 35	1276	wmic.exe
Token: 36	1276	wmic.exe
Token: SeIncreaseQuotaPrivilege	2348	wmic.exe
Token: SeSecurityPrivilege	2348	wmic.exe
Token: SeTakeOwnershipPrivilege	2348	wmic.exe
Token: SeLoadDriverPrivilege	2348	wmic.exe
Token: SeSystemProfilePrivilege	2348	wmic.exe
Token: SeSystemtimePrivilege	2348	wmic.exe
Token: SeProfSingleProcessPrivilege	2348	wmic.exe
Token: SeIncBasePriorityPrivilege	2348	wmic.exe
Token: SeCreatePagefilePrivilege	2348	wmic.exe
Token: SeBackupPrivilege	2348	wmic.exe
Token: SeRestorePrivilege	2348	wmic.exe
Token: SeShutdownPrivilege	2348	wmic.exe
Token: SeDebugPrivilege	2348	wmic.exe
Token: SeSystemEnvironmentPrivilege	2348	wmic.exe
Token: SeRemoteShutdownPrivilege	2348	wmic.exe
Token: SeUndockPrivilege	2348	wmic.exe
Token: SeManageVolumePrivilege	2348	wmic.exe
Token: 33	2348	wmic.exe
Token: 34	2348	wmic.exe
Token: 35	2348	wmic.exe
Token: 36	2348	wmic.exe
Token: SeIncreaseQuotaPrivilege	2348	wmic.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 2592	4704	04d8bd0abfe9c448f8b3f08c8c181390.exe	21
PID 4704 wrote to memory of 2592	4704	04d8bd0abfe9c448f8b3f08c8c181390.exe	21
PID 4704 wrote to memory of 2592	4704	04d8bd0abfe9c448f8b3f08c8c181390.exe	21
PID 2592 wrote to memory of 1276	2592	1431831751.exe	24
PID 2592 wrote to memory of 1276	2592	1431831751.exe	24
PID 2592 wrote to memory of 1276	2592	1431831751.exe	24
PID 2592 wrote to memory of 2348	2592	1431831751.exe	34
PID 2592 wrote to memory of 2348	2592	1431831751.exe	34
PID 2592 wrote to memory of 2348	2592	1431831751.exe	34
PID 2592 wrote to memory of 4120	2592	1431831751.exe	29
PID 2592 wrote to memory of 4120	2592	1431831751.exe	29
PID 2592 wrote to memory of 4120	2592	1431831751.exe	29
PID 2592 wrote to memory of 3156	2592	1431831751.exe	33
PID 2592 wrote to memory of 3156	2592	1431831751.exe	33
PID 2592 wrote to memory of 3156	2592	1431831751.exe	33
PID 2592 wrote to memory of 3536	2592	1431831751.exe	32
PID 2592 wrote to memory of 3536	2592	1431831751.exe	32
PID 2592 wrote to memory of 3536	2592	1431831751.exe	32

C:\Users\Admin\AppData\Local\Temp\04d8bd0abfe9c448f8b3f08c8c181390.exe
"C:\Users\Admin\AppData\Local\Temp\04d8bd0abfe9c448f8b3f08c8c181390.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\1431831751.exe
  C:\Users\Admin\AppData\Local\Temp\1431831751.exe 1|8|9|1|7|0|2|1|0|1|0 LkhAQzYzLjEyHy9STTlPQkQ7LyAuTkRMTk5LS0dDPS8gLjxAUk1JQjwyNjI2LBcuPElCPDAfL09KRkNOQ1JeSUM9MC4wMxkvUURSVUVRV0xRRT1mc3RvOi4nanFvLkJEU0otU0dHLDpQTi1JTUZOGCZCRUlBSklDPXZMJ0NKM0A4TS9WNkxCOERHTEM4QFFKMBcuPTE7MDEvMjAYJkMrPSswIC5EMjUkMBkvQjM9LDEfJzs0Ni0vHy9PUk48TEJNX05RSVVBQlE0HyhQUE5EVENTVzxURUE7Hy9PUk48TEJNX0xATUQ9Hyc8Vz5fU1FMPCAuPU9EWENLQ0xITkQ1Fy5BT1FTX0FSTk9KREs9Lh8vU0hARkJYSFVdVFJLPR8nTUw2Mh4uRFIxPBgmUU5OUkhNRF9WPUNCSE1DSE1AR0RNSUs2IC1IU15SVEZLSEZFO3NydGUfJ0lETVVQTUlNR15NSkRLX0JAWVI9MRgmR0JEQ1c9MCAuQUpePVlMQE1IQ149RUJLWU5TRUM9ZVljcl4gLUNPVk5LRzhDWElOPDY1LjAoKS0xLi82MR8vU0FERDYxMjIxNzM3Ly8wGS9CTldNTE45O15NSUtEPTQvMC8mMSkxMyk0OTU4MiswI0FLHy9UQTxFZnlibGpgJTFmNCYnKiFXZ21kbndyI0VTJDYsMCUyYipPRlYvNCMyYipUcWFbZGd0IzFmNi4vHSphJHJ0JDNgMTAmJygkbGdqZSpHZFtibhkvU1FMPGhzbGckLGEjMWYkMmVfXHMqLi4wMTBkZGtgZmcuZ21mbiUxXkl0Z1RnbGVDb3ZmY25aZEtgbmBnZGpWY15wam55JDJlKSsyKjgxNzc3MCQqXWNod2xrb2BkbFllYGBlcCQyZTEzKyg3LDg1NzAkM2UwKzcuODcwNjA2MVApRWxTZzdyT21uMENSLXFKZzVlTlJjKUs9WXNJR1A1Skw8d0R5VG5QQm9qUDovKkxBam5MU3JkT2k6MUlSa2dYQmcvSXNBZVhpdjVJS25kUHpPMkxCc2pQZFVkWUVZWWFGNzBZVkdzYVZnZ1cxRmZXUHBoWGpVelM7ajdMREc3T0RjdExhTUZSaEVDUWtnPERpMkpQeUFnWVVobGA9d3E=
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703440115.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703440115.txt bios get version
    3⤵
    PID:4120
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703440115.txt bios get version
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703440115.txt bios get version
    3⤵
    PID:3156
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703440115.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 948
    3⤵
    - Program crash
    PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2592 -ip 2592
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1431831751.exe

Filesize
123KB

MD5
9dfc0b409d5dce884b359130bedecd6e

SHA1
0c6bef677e0f8dde6fd256803347ebd5c78039ba

SHA256
f81107cdfcf939971b65d4b540d6ba6d5dcd6858857f4b9377c07b2ef5bef969

SHA512
e063c9d041aa73718bbff5167f6789dd68042ca080911f42e6fb55f045edbaef6b901f0476ce84426a4a05ade61fd6628aec494e5e8caa761a7c54c09177583f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1431831751.exe

Filesize
136KB

MD5
ea6c9597dafe1fd9e5014c0cee556d42

SHA1
fd95961df88a37c17f2188a8723806ad9dbd511c

SHA256
c8f9998ca372a4c0e22639a2fd27bbbef2fcc0c9a9da8125bca40aad76e90ea6

SHA512
be3a4321a748ae0087352b0347f2d7e4a14e4699d6271df4373309b0a7b7449145eccdbe2bd0de2b1aa46e97651910f8a07bfb4bb792481bdee8c7fcffc08b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703440115.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703440115.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703440115.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk5303.tmp\cgibuti.dll

Filesize
153KB

MD5
9b081b4f84974a46cffcf1ef1a2e85f9

SHA1
70a1b83bad19d28195f2df22c3d213a04b42fb2b

SHA256
303f74df9812b639b66f919804039d1e295ffae8e543fa4349507110ac766752

SHA512
4539a458b1d2ba61ffcf71ea59addd13727d26606f73dbfb21053d68d5656010dae5791d486789c14653c6fb953a7dc284c3a80db2b1970a0e7f0778ab77dbbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk5303.tmp\cgibuti.dll

Filesize
122KB

MD5
735855f5b99e2733275dc9d05f4f68db

SHA1
fc21ec6ea144cb1813da4d2e284369ed48285d62

SHA256
c5fcafa46153e15cce514ff09ebbef8984a0b97eefdea76a18acbb10fd8be08d

SHA512
0424d09a3793f8fb92fa73fe8440ba1726322872ef3597bd2efb067a4035069a43598ec1c2b49ef264cc783bb8dcc0702520c071ce9646cab5d5c9dc9a6eb85c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk5303.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit