9761f0e6484618139fbafb875ac0b0012316df660f3c71c4dd218eacef3eecb8

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

114de29ca6bb557f25490715d794ea62.exe
Size

581KB
MD5

114de29ca6bb557f25490715d794ea62
SHA1

a664f74c52c8e51c0787ac381854f953e202ccf3
SHA256

9761f0e6484618139fbafb875ac0b0012316df660f3c71c4dd218eacef3eecb8
SHA512

aab7a1c7104d91b9b8610849ab8ef92d9842feb894be355c45abe5bdaadf3d2e85b6ff1a80229aed7c5842e58aca5e9f2152d5ec8ee2045d7c2404c43b276e76
SSDEEP

12288:G2y4hUnM8rC6ibkVAw9gPdR0YaFYponURzneJOYLT5go9GlT:GX4hmjrebk29PdR0Kponczne4W5y

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2252	1431820951.exe

Loads dropped DLL 11 IoCs

pid	Process
1704	114de29ca6bb557f25490715d794ea62.exe
1704	114de29ca6bb557f25490715d794ea62.exe
1704	114de29ca6bb557f25490715d794ea62.exe
1704	114de29ca6bb557f25490715d794ea62.exe
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
776	2252	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2856	wmic.exe
Token: SeSecurityPrivilege	2856	wmic.exe
Token: SeTakeOwnershipPrivilege	2856	wmic.exe
Token: SeLoadDriverPrivilege	2856	wmic.exe
Token: SeSystemProfilePrivilege	2856	wmic.exe
Token: SeSystemtimePrivilege	2856	wmic.exe
Token: SeProfSingleProcessPrivilege	2856	wmic.exe
Token: SeIncBasePriorityPrivilege	2856	wmic.exe
Token: SeCreatePagefilePrivilege	2856	wmic.exe
Token: SeBackupPrivilege	2856	wmic.exe
Token: SeRestorePrivilege	2856	wmic.exe
Token: SeShutdownPrivilege	2856	wmic.exe
Token: SeDebugPrivilege	2856	wmic.exe
Token: SeSystemEnvironmentPrivilege	2856	wmic.exe
Token: SeRemoteShutdownPrivilege	2856	wmic.exe
Token: SeUndockPrivilege	2856	wmic.exe
Token: SeManageVolumePrivilege	2856	wmic.exe
Token: 33	2856	wmic.exe
Token: 34	2856	wmic.exe
Token: 35	2856	wmic.exe
Token: SeIncreaseQuotaPrivilege	2856	wmic.exe
Token: SeSecurityPrivilege	2856	wmic.exe
Token: SeTakeOwnershipPrivilege	2856	wmic.exe
Token: SeLoadDriverPrivilege	2856	wmic.exe
Token: SeSystemProfilePrivilege	2856	wmic.exe
Token: SeSystemtimePrivilege	2856	wmic.exe
Token: SeProfSingleProcessPrivilege	2856	wmic.exe
Token: SeIncBasePriorityPrivilege	2856	wmic.exe
Token: SeCreatePagefilePrivilege	2856	wmic.exe
Token: SeBackupPrivilege	2856	wmic.exe
Token: SeRestorePrivilege	2856	wmic.exe
Token: SeShutdownPrivilege	2856	wmic.exe
Token: SeDebugPrivilege	2856	wmic.exe
Token: SeSystemEnvironmentPrivilege	2856	wmic.exe
Token: SeRemoteShutdownPrivilege	2856	wmic.exe
Token: SeUndockPrivilege	2856	wmic.exe
Token: SeManageVolumePrivilege	2856	wmic.exe
Token: 33	2856	wmic.exe
Token: 34	2856	wmic.exe
Token: 35	2856	wmic.exe
Token: SeIncreaseQuotaPrivilege	2616	wmic.exe
Token: SeSecurityPrivilege	2616	wmic.exe
Token: SeTakeOwnershipPrivilege	2616	wmic.exe
Token: SeLoadDriverPrivilege	2616	wmic.exe
Token: SeSystemProfilePrivilege	2616	wmic.exe
Token: SeSystemtimePrivilege	2616	wmic.exe
Token: SeProfSingleProcessPrivilege	2616	wmic.exe
Token: SeIncBasePriorityPrivilege	2616	wmic.exe
Token: SeCreatePagefilePrivilege	2616	wmic.exe
Token: SeBackupPrivilege	2616	wmic.exe
Token: SeRestorePrivilege	2616	wmic.exe
Token: SeShutdownPrivilege	2616	wmic.exe
Token: SeDebugPrivilege	2616	wmic.exe
Token: SeSystemEnvironmentPrivilege	2616	wmic.exe
Token: SeRemoteShutdownPrivilege	2616	wmic.exe
Token: SeUndockPrivilege	2616	wmic.exe
Token: SeManageVolumePrivilege	2616	wmic.exe
Token: 33	2616	wmic.exe
Token: 34	2616	wmic.exe
Token: 35	2616	wmic.exe
Token: SeIncreaseQuotaPrivilege	2744	wmic.exe
Token: SeSecurityPrivilege	2744	wmic.exe
Token: SeTakeOwnershipPrivilege	2744	wmic.exe
Token: SeLoadDriverPrivilege	2744	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2252	1704	114de29ca6bb557f25490715d794ea62.exe	28
PID 1704 wrote to memory of 2252	1704	114de29ca6bb557f25490715d794ea62.exe	28
PID 1704 wrote to memory of 2252	1704	114de29ca6bb557f25490715d794ea62.exe	28
PID 1704 wrote to memory of 2252	1704	114de29ca6bb557f25490715d794ea62.exe	28
PID 2252 wrote to memory of 2856	2252	1431820951.exe	29
PID 2252 wrote to memory of 2856	2252	1431820951.exe	29
PID 2252 wrote to memory of 2856	2252	1431820951.exe	29
PID 2252 wrote to memory of 2856	2252	1431820951.exe	29
PID 2252 wrote to memory of 2616	2252	1431820951.exe	32
PID 2252 wrote to memory of 2616	2252	1431820951.exe	32
PID 2252 wrote to memory of 2616	2252	1431820951.exe	32
PID 2252 wrote to memory of 2616	2252	1431820951.exe	32
PID 2252 wrote to memory of 2744	2252	1431820951.exe	34
PID 2252 wrote to memory of 2744	2252	1431820951.exe	34
PID 2252 wrote to memory of 2744	2252	1431820951.exe	34
PID 2252 wrote to memory of 2744	2252	1431820951.exe	34
PID 2252 wrote to memory of 2592	2252	1431820951.exe	37
PID 2252 wrote to memory of 2592	2252	1431820951.exe	37
PID 2252 wrote to memory of 2592	2252	1431820951.exe	37
PID 2252 wrote to memory of 2592	2252	1431820951.exe	37
PID 2252 wrote to memory of 2256	2252	1431820951.exe	38
PID 2252 wrote to memory of 2256	2252	1431820951.exe	38
PID 2252 wrote to memory of 2256	2252	1431820951.exe	38
PID 2252 wrote to memory of 2256	2252	1431820951.exe	38
PID 2252 wrote to memory of 776	2252	1431820951.exe	40
PID 2252 wrote to memory of 776	2252	1431820951.exe	40
PID 2252 wrote to memory of 776	2252	1431820951.exe	40
PID 2252 wrote to memory of 776	2252	1431820951.exe	40

C:\Users\Admin\AppData\Local\Temp\114de29ca6bb557f25490715d794ea62.exe
"C:\Users\Admin\AppData\Local\Temp\114de29ca6bb557f25490715d794ea62.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\1431820951.exe
  C:\Users\Admin\AppData\Local\Temp\1431820951.exe 8]3]4]9]9]5]7]4]8]5]3 J01FOzQuKS4qGyxLUj5HQD82LBgqSz1RU0ZJRkJANSsdJ0FFSktEPTkqMi8vLxwmOkQ9OSgbLEhPSztMPk1bQT86KTM1KxcqTEFKUUJKXFFJQzhhcGxrNycsb2ltKT1BS0YqTExMJDhLSSpBSUNHHSs6Q0Q8R0E/Om9JSj4tPkRETkcuLzVEMEIrLUAvM0YuTxwmOyw2LSkrLS0dKzspOCYtGCpBKzopKBcqPTA1KC4YLEAsNCgqHCdLT0dBUTpLWklOQVE+O1Y5FyZLS0s8UEBMXEFMQzw2HCdLT0dBUTpLWkc9RUA6GCxBTzxaTk5EOB0nQlQ8Vj5GQERESz06HCY/SkxQVz1PR1RPPEk4KRwnT0U5S0dQRlBYUUpHOhgsUkQ0LRkrPE4uNR0rSUxJTUVFQFxPQkg6Rkg+RUU8RD1STkM0GyhFS1pPTUtQQERANnBqcGIYLE48S1BLSkFJRFdSTzxJWj09UU46Kh0rP0A/PlQ1LB0nRk9WO1RHPUVEQFdCSjpJVElQPT86Xl5oalwbKEBHUktETD07VkRJOS4xKyktLiUtKSsuLRssTEZJPDQsLS8pMy8tNiwoFyo9S09JSUc+QFZLREZBNTAsKTQrKScsLiYpNS8tNywoITxGHCdQPjVKa3FgZ2VdHS1jLSssIh9SYmpcanRrKEpLIjEnLR0uXyNUS04tLx4vWiZRamZgXGVvHi5eMisoIi9ZIm1vIStcLikrLCAiZ2JnXSZEXWBnZhcqTk5EOGVscWwcKlweLl4gL15kYWsoKSktKSxhXXBlXmUpYmpeaiIqY05sZU9iaV0/bG9raGZYX0ZdZlxkXW9bW1xrZWtxIC9eLjAqKDMrMTErLx0vYltmcmdoZ1xhZV5qWF5gayEqYS4sMC0vKTAyLCogMF4uMysuMCwzKy40MVdoLG5OPUVwSkQoM0g6WnNEdUJfTDs1c0NxTGtET24vRFA0J0RNMm5HZGhcVnVmLEZic2xGUUFnVEpiM0NlKGFVcj4uQmAvX1NySC9DUGtfUE4tMkNkbFxXU0FmU2ZoXVVqQTNePW91W2lvYVVlaWVQPmNiU3JzdEtCYDpEdXFFSlA2PEpAOCdMTU5BRlE+P0k6MERFLCxhVz8/a1hxams=
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703520535.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703520535.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703520535.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703520535.txt bios get version
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703520535.txt bios get version
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 372
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1431820951.exe

Filesize
575KB

MD5
47ddc90de7fe44174efd4ea9ce59d1a5

SHA1
738c86717d1b4607a62704b73c5aa190f24f5682

SHA256
469551e588189713508f8d5b28ac9c7e4a7125a47cee5020dc30fd0a9e4fb789

SHA512
10432b77a77cfe3e0924e4800df5b83db5a81c9ff3e5955495541a3fc1b0994e0a9093be1a15bd363a633797958db4221e6ce0cfe1f7c4de3a38148f62f8aeea

Download Submit
C:\Users\Admin\AppData\Local\Temp\1431820951.exe

Filesize
309KB

MD5
b84c6d13d094a794e9076c91517552f6

SHA1
6ea165e99c0b63bb8248ae305099c45b9fc255a4

SHA256
cb41953a66776fc41badd9966ed20c6994fa381d3d587878f20d1120991ed591

SHA512
52e171069459e4b7c3905b4ef4d7744cfdb553cb9914f0fca7862e78fae286f248fc2ea2df4d57a8e120cf29ef294cd078b70cb9e115cfc54e2943fd94911049

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703520535.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\1431820951.exe

Filesize
788KB

MD5
ad1b752c05bd56b0b40a7eb1e0cc877f

SHA1
cac56d3f0e2cb6db3052f0b5eb23d62dc7f8439d

SHA256
69a512cbf83a97951ee3576d83b71442fea4e74d18c4968c1141234b1b3ffb97

SHA512
124f2e6ea3f129e4a88be4fcbf90d3b305cfc19b815558024f4e71101dbebe98b0a43fa11a35db8fb4159007527a1596018ee0c7c67846c1a244cb976505240e

Download Submit
\Users\Admin\AppData\Local\Temp\1431820951.exe

Filesize
512KB

MD5
70f7c2360c24f6e2b98bc4a7cd904307

SHA1
7902ef7bf0ccd49f0771fb904dcb5736fa18bbb0

SHA256
3618ad15c661a72816f76478e07ffc77932149f1ca44682cbcdefe4a2b01a037

SHA512
f8bb6bbaea4fbbfee71af26ac0a34c5d001d4863bfde5d9ac6ad8b66a0be06ce1f7421b951d3cc545f1a8c29b441e85d146c5cbc61c1e1d5191da793cd5536c3

Download Submit
\Users\Admin\AppData\Local\Temp\1431820951.exe

Filesize
591KB

MD5
c3a6f2013279f41c85684e01db4a33c1

SHA1
d52cb512a6af3f56f5d7c9ce561b9fad18b76e2c

SHA256
e14e72c8db65e491b3da9e7e4fd344ed8b5fdbf441bfaa7d4916fe6cdf5dd680

SHA512
7cf2a3627188f0b7851d42e9668d9ac3b04c8ce61c7671104fa0d359113aadb7b76bc6e31aa3f776c1875f3243d6128c0499f4f67e21c755de4e29d1843b6398

Download Submit
\Users\Admin\AppData\Local\Temp\1431820951.exe

Filesize
665KB

MD5
9b6c963b7370bf26151aa8a795ce9282

SHA1
a543723fa981aabe659f4e83e13182650e0acc73

SHA256
714062b255daf9a84e9f56e26efa3ec01848ac8bdbc76e2fa663561bc7931613

SHA512
dd826f8fc3d0c78fba7129d5fcda7740c345c21c78fd05fdc165e7d0e2647b2db732105d1ce66ec7bb1865110797e6cc7a32eb3a9c3ac2aa0449e78f336f9ed2

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8631.tmp\kaxgcem.dll

Filesize
153KB

MD5
64ffd6dbd03f55408fbc6640317368f0

SHA1
227d86d47d53d5f62a2227e6d2b282519d38005d

SHA256
b8d9b2c53ea62560b03c2ef9f139370380b4c931d1fc02172bc7e1a98e41ffc3

SHA512
ba03c31e00ec24a7bd4e59088feaee3eb389b459cbd041613222f95d9ea1689920127d390d81c2e0000ccf72f67a2043cf81dd324cab3c887003aa93783501c8

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8631.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit