6f58bfe1384bd00b751dc149e6481ac8d25c0ba8e7802cfe4ffd0e04a21d91d1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

106184ffaa10a175498cb643031b9219.exe
Size

581KB
MD5

106184ffaa10a175498cb643031b9219
SHA1

90427987ed6c0f65555118f40d88ff67ed20d0d2
SHA256

6f58bfe1384bd00b751dc149e6481ac8d25c0ba8e7802cfe4ffd0e04a21d91d1
SHA512

5943c25763d13667def495a495b2d8212a5c20ff146def7ba7fc0f957ff626b0cd17ab774825c4a1d28cfde55a0693f80d1cb144284bc545102aca054c3ef74e
SSDEEP

12288:gZYN1dQYFlzCY0sBTy3DUgu0CFWI2bXrsiL7yunEZL7TI6VNt:goplzZ0oeDwXWrDrsiLYZL5N

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2824	1431788551.exe

Loads dropped DLL 11 IoCs

pid	Process
2668	106184ffaa10a175498cb643031b9219.exe
2668	106184ffaa10a175498cb643031b9219.exe
2668	106184ffaa10a175498cb643031b9219.exe
2668	106184ffaa10a175498cb643031b9219.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2932	2824	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2736	wmic.exe
Token: SeSecurityPrivilege	2736	wmic.exe
Token: SeTakeOwnershipPrivilege	2736	wmic.exe
Token: SeLoadDriverPrivilege	2736	wmic.exe
Token: SeSystemProfilePrivilege	2736	wmic.exe
Token: SeSystemtimePrivilege	2736	wmic.exe
Token: SeProfSingleProcessPrivilege	2736	wmic.exe
Token: SeIncBasePriorityPrivilege	2736	wmic.exe
Token: SeCreatePagefilePrivilege	2736	wmic.exe
Token: SeBackupPrivilege	2736	wmic.exe
Token: SeRestorePrivilege	2736	wmic.exe
Token: SeShutdownPrivilege	2736	wmic.exe
Token: SeDebugPrivilege	2736	wmic.exe
Token: SeSystemEnvironmentPrivilege	2736	wmic.exe
Token: SeRemoteShutdownPrivilege	2736	wmic.exe
Token: SeUndockPrivilege	2736	wmic.exe
Token: SeManageVolumePrivilege	2736	wmic.exe
Token: 33	2736	wmic.exe
Token: 34	2736	wmic.exe
Token: 35	2736	wmic.exe
Token: SeIncreaseQuotaPrivilege	2736	wmic.exe
Token: SeSecurityPrivilege	2736	wmic.exe
Token: SeTakeOwnershipPrivilege	2736	wmic.exe
Token: SeLoadDriverPrivilege	2736	wmic.exe
Token: SeSystemProfilePrivilege	2736	wmic.exe
Token: SeSystemtimePrivilege	2736	wmic.exe
Token: SeProfSingleProcessPrivilege	2736	wmic.exe
Token: SeIncBasePriorityPrivilege	2736	wmic.exe
Token: SeCreatePagefilePrivilege	2736	wmic.exe
Token: SeBackupPrivilege	2736	wmic.exe
Token: SeRestorePrivilege	2736	wmic.exe
Token: SeShutdownPrivilege	2736	wmic.exe
Token: SeDebugPrivilege	2736	wmic.exe
Token: SeSystemEnvironmentPrivilege	2736	wmic.exe
Token: SeRemoteShutdownPrivilege	2736	wmic.exe
Token: SeUndockPrivilege	2736	wmic.exe
Token: SeManageVolumePrivilege	2736	wmic.exe
Token: 33	2736	wmic.exe
Token: 34	2736	wmic.exe
Token: 35	2736	wmic.exe
Token: SeIncreaseQuotaPrivilege	2960	wmic.exe
Token: SeSecurityPrivilege	2960	wmic.exe
Token: SeTakeOwnershipPrivilege	2960	wmic.exe
Token: SeLoadDriverPrivilege	2960	wmic.exe
Token: SeSystemProfilePrivilege	2960	wmic.exe
Token: SeSystemtimePrivilege	2960	wmic.exe
Token: SeProfSingleProcessPrivilege	2960	wmic.exe
Token: SeIncBasePriorityPrivilege	2960	wmic.exe
Token: SeCreatePagefilePrivilege	2960	wmic.exe
Token: SeBackupPrivilege	2960	wmic.exe
Token: SeRestorePrivilege	2960	wmic.exe
Token: SeShutdownPrivilege	2960	wmic.exe
Token: SeDebugPrivilege	2960	wmic.exe
Token: SeSystemEnvironmentPrivilege	2960	wmic.exe
Token: SeRemoteShutdownPrivilege	2960	wmic.exe
Token: SeUndockPrivilege	2960	wmic.exe
Token: SeManageVolumePrivilege	2960	wmic.exe
Token: 33	2960	wmic.exe
Token: 34	2960	wmic.exe
Token: 35	2960	wmic.exe
Token: SeIncreaseQuotaPrivilege	2584	wmic.exe
Token: SeSecurityPrivilege	2584	wmic.exe
Token: SeTakeOwnershipPrivilege	2584	wmic.exe
Token: SeLoadDriverPrivilege	2584	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2824	2668	106184ffaa10a175498cb643031b9219.exe	28
PID 2668 wrote to memory of 2824	2668	106184ffaa10a175498cb643031b9219.exe	28
PID 2668 wrote to memory of 2824	2668	106184ffaa10a175498cb643031b9219.exe	28
PID 2668 wrote to memory of 2824	2668	106184ffaa10a175498cb643031b9219.exe	28
PID 2824 wrote to memory of 2736	2824	1431788551.exe	29
PID 2824 wrote to memory of 2736	2824	1431788551.exe	29
PID 2824 wrote to memory of 2736	2824	1431788551.exe	29
PID 2824 wrote to memory of 2736	2824	1431788551.exe	29
PID 2824 wrote to memory of 2960	2824	1431788551.exe	32
PID 2824 wrote to memory of 2960	2824	1431788551.exe	32
PID 2824 wrote to memory of 2960	2824	1431788551.exe	32
PID 2824 wrote to memory of 2960	2824	1431788551.exe	32
PID 2824 wrote to memory of 2584	2824	1431788551.exe	34
PID 2824 wrote to memory of 2584	2824	1431788551.exe	34
PID 2824 wrote to memory of 2584	2824	1431788551.exe	34
PID 2824 wrote to memory of 2584	2824	1431788551.exe	34
PID 2824 wrote to memory of 2664	2824	1431788551.exe	36
PID 2824 wrote to memory of 2664	2824	1431788551.exe	36
PID 2824 wrote to memory of 2664	2824	1431788551.exe	36
PID 2824 wrote to memory of 2664	2824	1431788551.exe	36
PID 2824 wrote to memory of 756	2824	1431788551.exe	38
PID 2824 wrote to memory of 756	2824	1431788551.exe	38
PID 2824 wrote to memory of 756	2824	1431788551.exe	38
PID 2824 wrote to memory of 756	2824	1431788551.exe	38
PID 2824 wrote to memory of 2932	2824	1431788551.exe	40
PID 2824 wrote to memory of 2932	2824	1431788551.exe	40
PID 2824 wrote to memory of 2932	2824	1431788551.exe	40
PID 2824 wrote to memory of 2932	2824	1431788551.exe	40

C:\Users\Admin\AppData\Local\Temp\106184ffaa10a175498cb643031b9219.exe
"C:\Users\Admin\AppData\Local\Temp\106184ffaa10a175498cb643031b9219.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\1431788551.exe
  C:\Users\Admin\AppData\Local\Temp\1431788551.exe 3^4^5^7^5^2^1^1^8^4^5 LExEPTgxLzEqHCpQUT1JREI8LxgrSUJQUkhNSUhDNSwbLEBETE9HQzwqMy00LhsoPkdDPCgcKk1OSj1QQVNeQUA4LjI0LRstUkRKUkBPW1BLRztnc2xsNSwrbmtxLENES0coUUtLJjxOTy1BSkFMHCo8R0dCSkFAOHRJPTwtTDdGOjBELiwzMkZFR0gpPz0+SRsoPy88MCksMzEcKj0tOywwGCs/MDkoKhstQzM1KSwdKz8uOCswHydMTUxAUDxPXU9RQVI8QFU4GSpOUU48UT5RW0BORz88HydMTUxAUDxPXU1ARUE4HStAUUBdVFFEORssQVM+WkFMQ0RFSUI5GyhDTVJTVz5NTFNOPk07Lx8nUEM+SkZSSlNeVEpIOB0rUUY4MB8uPE8sOhwqS1BMU0hFQVpUQUc8SktESEU9QkJRTUU4Hi5IS1tNUkpPQkhDPHNqcWAdK00+T1NRTUFKQlxRTj5NXUNAUU84LxwqQURCRFc1LRssRU5YP1dNQEVFPlxBSTxNV09TPUA4Y11nbGAeLkNHU0lJSzw9WkdPPC4yKS4sLSczLDEvMRwqUUVIPjgvMzIpMzQvNSsrGy1DTk9KR0w9P1hPR0xENTEqLjIqKysvNCksNiwyNisrJU5MHydRPDpJanNkamtgHS5hMiorJCNVaG1ca3JwJ0lNJjQtMB0vXShQbWJfY21zHS5hNCorHi5gKnFuIS5eLSwnKycqa2FnYChDYFxmbR8uTU5HOmRvbWsjMmAdLmEiLmFgYHIwLSgtLC5gYGxkZW0tYWphbCEtX01zbVNhaWBBa3JnZ21gY0VdaV5jYGtaYmRvZGt0Ii5hKi8xMDYxLjQtLyArYWJudmZoal5gaFppX2ZkaiEtYy0vLCw1ODExLC4iL2ExNDQ0MjEuMS0tMVEsdnRSYk1tTVNqMkhnbnBDTz1jS2RkLEpDYnBFQk4sRnNAMEp4SmtLUDRiUT5lMks7MGlLZS9mVHd2MEI/bmVVTmgySHlEZFRkdCxFcnJoVnlFL0dRPWJRaEBsWD9wVF4tMzJeajhyWkNqZVVCR2lWVnNnVGVTcU1zLD9KVG91TS1BcEpOZXBMclY+T1FFQ0hCLzVHQV5lVmdpb19DL3A=
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703515466.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703515466.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703515466.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703515466.txt bios get version
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703515466.txt bios get version
    3⤵
    PID:756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 372
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81703515466.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\1431788551.exe

Filesize
788KB

MD5
34999992f71f7b404a67bcc00ba29a41

SHA1
5c786fa73c3f627b3661a97b9fd46d50ffd6a0bd

SHA256
65b7d7fa04ed6401ad3e051575baf3ce489f3f66c8e954b4c08dc59fdbd7b77e

SHA512
60602f4862743558886cea5b8b732e67b9a78c3076f090e209bcbcf3fd97ae8ae9747fbbd8487f9750ad1de6d50491ca5ce9b16cf38ef845a9a7ed720464ad13

Download Submit
\Users\Admin\AppData\Local\Temp\1431788551.exe

Filesize
745KB

MD5
973a822c82fccb500d79c557f5f1b657

SHA1
3d829eab8189917c12e69447eb05bd4621086773

SHA256
98ae8bccc0109a2630c664ffb4674e99118579226eeefffa84cb01d9f67eb387

SHA512
fd266bbe1c0a174effd7924eb4ba23cec5c6ccf83eb188dfceefe615540891d1d42082f56e0a4d3c5b7a97b60db4e4d230fc6ba0d036fba89d7dbe4ad1f72f0a

Download Submit
\Users\Admin\AppData\Local\Temp\1431788551.exe

Filesize
637KB

MD5
d3eb92c56edf7ca8ff9b9ec3928808ef

SHA1
6eea06316837fd2d3f196159991baf50052e5436

SHA256
b9bb0a96bff763f450b001554c9b340514d79a86b310dbbeb6fd15ea828a9ece

SHA512
170c7302554c0ec66d7e73f041c02a3f5221407bd63fab99f07cf410eccac9dcf55db873b26569693f17b7acb108f43280e143c81abb1caebca713a12284efde

Download Submit
\Users\Admin\AppData\Local\Temp\1431788551.exe

Filesize
624KB

MD5
5bfa17a214dd60c2de25d83eb49a7b0c

SHA1
5d9fc511297580acc73eb7358b572143716159fd

SHA256
c0fa551ce81207b4373f7ac1f7741d26d1c07501ce69b5ab0c752c818fa4bdf4

SHA512
2bad046d6eb3792734588f90d58d501d19de08a065061d889d7de4c1cf2066480917e326bb0a38ebd6ad06c1d98d90340bd442e3dc77e000b6bd34904012c086

Download Submit
\Users\Admin\AppData\Local\Temp\1431788551.exe

Filesize
461KB

MD5
3e50ac0afcc5978f61d9c10f25a6a18c

SHA1
aded63d2fe46da725becaa380f8c5f29f571cec8

SHA256
2567b92a402c2f372cf5a8d926fac1e0bd9ea1239397d79c786db084e0a5302a

SHA512
3989cfb9ba9474e57e301acbc999c17fac61286e70f7a979dddba9d93084001811d16dd5dfa65d6a8086cde9ef430e11428a9ba165aec1a7a1e3357fbaf15d63

Download Submit
\Users\Admin\AppData\Local\Temp\1431788551.exe

Filesize
462KB

MD5
df3e1d2a070dc8453c722c9d77e24e25

SHA1
21536c2486c2a50f62770418976db80b00ee0f41

SHA256
8ce16138839d9dec358b5b2c4e845a6380d2d7c70383ff0f4dd5d0be7ee7a24f

SHA512
d188db31b5ea6bf6fb5a3f1d8a9358c358608f0f43f7f8509d495bd959b657dacf89facdccd361cfb4e8cd2c83cb992e4fbb8462ef2f4d398da9f0ff534854d0

Download Submit
\Users\Admin\AppData\Local\Temp\1431788551.exe

Filesize
457KB

MD5
6ab60587f809c1f1304aa5832ee160e4

SHA1
613f8c6e3f8a2c32340d02fdbbf6f04487401ea8

SHA256
618006968f86f59db53f8d7dd3f22ec99f871c9bf3bda8e239d8b788f3a35a8d

SHA512
df5afb843a89b8ddf7130a0eadae6683788c96ace6dbfb59e4e3ca1ca12671fc53a9b56c3d31f456683989b243d43c3f907ff46ae905e393f20697f35fd7be9d

Download Submit
\Users\Admin\AppData\Local\Temp\1431788551.exe

Filesize
171KB

MD5
3e8d2606d0cc23100e75933c8d76b0a3

SHA1
f67188931085f5d8ce504ee50669031acb43d80a

SHA256
a1e34e5b44c37f8eed6d29511aa360deafccca3778f482ec00a4ad4176509ed4

SHA512
a1ab2b89a5c2fc6cd253eedb6227a6835a5119b1303c5f7125fba263fdee5249d00ab01693e5946a471b2085a04bca978c9e541b1c35df143a14131404899541

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3083.tmp\ibcdrur.dll

Filesize
153KB

MD5
cc7702c331fd2b2201d356a02401e5bc

SHA1
11cd196fd5b3c11de259da2c8ccc3a5d9161c09a

SHA256
3516da154df6fe34fd628e20df3e2a71ffe7d6795cb2f481869ab475f69d9291

SHA512
7bdb51b6032d9dbd418b74e48aede845a537ed13ee50f7019289d041b1de72966db88545cfabc48ebef72e7b881faed2cb180544bce43eb6e48ba9fe67a34653

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3083.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit