c17663b78f0beb44ce1d50d5385eb6d00712c8abce78942e0cfc4db77df4420f

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1263aeb7669544ba5c597427740fd55a.exe
Size

644KB
MD5

1263aeb7669544ba5c597427740fd55a
SHA1

5d046d9ba0f861fd9f968b2fff565497bd8c453a
SHA256

c17663b78f0beb44ce1d50d5385eb6d00712c8abce78942e0cfc4db77df4420f
SHA512

9b758e116b8b63b2595310bbfbd1af9a9b3600a8fa586cc256d8f12f68bd0cb29bad2f995b02b876fe1a1a154b4d3808fe45613c247f7442f7643746a80ed6dc
SSDEEP

12288:FPyQb80zXZWoqVAZ5qLAZvI5oazdlYGvK7y/nRleafc8vy4h3:FPN80zLfzq025oazw/7cn2386+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1400	bedfhaijcd.exe

Loads dropped DLL 2 IoCs

pid	Process
1076	1263aeb7669544ba5c597427740fd55a.exe
1076	1263aeb7669544ba5c597427740fd55a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	1400	WerFault.exe	87

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4756	wmic.exe
Token: SeSecurityPrivilege	4756	wmic.exe
Token: SeTakeOwnershipPrivilege	4756	wmic.exe
Token: SeLoadDriverPrivilege	4756	wmic.exe
Token: SeSystemProfilePrivilege	4756	wmic.exe
Token: SeSystemtimePrivilege	4756	wmic.exe
Token: SeProfSingleProcessPrivilege	4756	wmic.exe
Token: SeIncBasePriorityPrivilege	4756	wmic.exe
Token: SeCreatePagefilePrivilege	4756	wmic.exe
Token: SeBackupPrivilege	4756	wmic.exe
Token: SeRestorePrivilege	4756	wmic.exe
Token: SeShutdownPrivilege	4756	wmic.exe
Token: SeDebugPrivilege	4756	wmic.exe
Token: SeSystemEnvironmentPrivilege	4756	wmic.exe
Token: SeRemoteShutdownPrivilege	4756	wmic.exe
Token: SeUndockPrivilege	4756	wmic.exe
Token: SeManageVolumePrivilege	4756	wmic.exe
Token: 33	4756	wmic.exe
Token: 34	4756	wmic.exe
Token: 35	4756	wmic.exe
Token: 36	4756	wmic.exe
Token: SeIncreaseQuotaPrivilege	4756	wmic.exe
Token: SeSecurityPrivilege	4756	wmic.exe
Token: SeTakeOwnershipPrivilege	4756	wmic.exe
Token: SeLoadDriverPrivilege	4756	wmic.exe
Token: SeSystemProfilePrivilege	4756	wmic.exe
Token: SeSystemtimePrivilege	4756	wmic.exe
Token: SeProfSingleProcessPrivilege	4756	wmic.exe
Token: SeIncBasePriorityPrivilege	4756	wmic.exe
Token: SeCreatePagefilePrivilege	4756	wmic.exe
Token: SeBackupPrivilege	4756	wmic.exe
Token: SeRestorePrivilege	4756	wmic.exe
Token: SeShutdownPrivilege	4756	wmic.exe
Token: SeDebugPrivilege	4756	wmic.exe
Token: SeSystemEnvironmentPrivilege	4756	wmic.exe
Token: SeRemoteShutdownPrivilege	4756	wmic.exe
Token: SeUndockPrivilege	4756	wmic.exe
Token: SeManageVolumePrivilege	4756	wmic.exe
Token: 33	4756	wmic.exe
Token: 34	4756	wmic.exe
Token: 35	4756	wmic.exe
Token: 36	4756	wmic.exe
Token: SeIncreaseQuotaPrivilege	3112	wmic.exe
Token: SeSecurityPrivilege	3112	wmic.exe
Token: SeTakeOwnershipPrivilege	3112	wmic.exe
Token: SeLoadDriverPrivilege	3112	wmic.exe
Token: SeSystemProfilePrivilege	3112	wmic.exe
Token: SeSystemtimePrivilege	3112	wmic.exe
Token: SeProfSingleProcessPrivilege	3112	wmic.exe
Token: SeIncBasePriorityPrivilege	3112	wmic.exe
Token: SeCreatePagefilePrivilege	3112	wmic.exe
Token: SeBackupPrivilege	3112	wmic.exe
Token: SeRestorePrivilege	3112	wmic.exe
Token: SeShutdownPrivilege	3112	wmic.exe
Token: SeDebugPrivilege	3112	wmic.exe
Token: SeSystemEnvironmentPrivilege	3112	wmic.exe
Token: SeRemoteShutdownPrivilege	3112	wmic.exe
Token: SeUndockPrivilege	3112	wmic.exe
Token: SeManageVolumePrivilege	3112	wmic.exe
Token: 33	3112	wmic.exe
Token: 34	3112	wmic.exe
Token: 35	3112	wmic.exe
Token: 36	3112	wmic.exe
Token: SeIncreaseQuotaPrivilege	3112	wmic.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1400	1076	1263aeb7669544ba5c597427740fd55a.exe	87
PID 1076 wrote to memory of 1400	1076	1263aeb7669544ba5c597427740fd55a.exe	87
PID 1076 wrote to memory of 1400	1076	1263aeb7669544ba5c597427740fd55a.exe	87
PID 1400 wrote to memory of 4756	1400	bedfhaijcd.exe	89
PID 1400 wrote to memory of 4756	1400	bedfhaijcd.exe	89
PID 1400 wrote to memory of 4756	1400	bedfhaijcd.exe	89
PID 1400 wrote to memory of 3112	1400	bedfhaijcd.exe	95
PID 1400 wrote to memory of 3112	1400	bedfhaijcd.exe	95
PID 1400 wrote to memory of 3112	1400	bedfhaijcd.exe	95
PID 1400 wrote to memory of 4636	1400	bedfhaijcd.exe	96
PID 1400 wrote to memory of 4636	1400	bedfhaijcd.exe	96
PID 1400 wrote to memory of 4636	1400	bedfhaijcd.exe	96
PID 1400 wrote to memory of 3144	1400	bedfhaijcd.exe	98
PID 1400 wrote to memory of 3144	1400	bedfhaijcd.exe	98
PID 1400 wrote to memory of 3144	1400	bedfhaijcd.exe	98
PID 1400 wrote to memory of 2208	1400	bedfhaijcd.exe	100
PID 1400 wrote to memory of 2208	1400	bedfhaijcd.exe	100
PID 1400 wrote to memory of 2208	1400	bedfhaijcd.exe	100

C:\Users\Admin\AppData\Local\Temp\1263aeb7669544ba5c597427740fd55a.exe
"C:\Users\Admin\AppData\Local\Temp\1263aeb7669544ba5c597427740fd55a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\bedfhaijcd.exe
  C:\Users\Admin\AppData\Local\Temp\bedfhaijcd.exe 9,9,1,1,6,5,8,4,3,2,0 JkdIQzcxKzQdLVNMOU9IPjgoHCxMRUtOTlFFRDw5Lh4vO0BSU0M/NTExMiAmOkhDNysYK01QTztMQlNZRDw5MTQxFyZSRExRPU5cU1JDNGdzbmsyKyxxcm0lQ0RNRiVQTE4tOEdPLUNJPksdLUNDQEJKQz81HCxCMTQrMTAuLSk0HS1EKTQwNCowGCtBMT0kKB8uPi81KS4eLzssPCwrGydMT01ETDpTXkpNQVI+QVk0Fy5PTEo8UUBSXzxMS0A3GydMT01ETDpTXkg8RUE6V29sa3RhXyAqLHNnZFxmJDEqX2dza2pvWFtkcR8tKGxvbSUpJ3UfKUBQQVxTUkM0Hy4/Uz1bQEtEQ0BNRDcbJ0RMUVRWOVFOUU49TjouICZLR0BIRlFLUl1VSUM8HylRRTkvHi87SjA8GipKUUtSSUQ8XlY/RztLSkNJRDhGRE9NRDkdLUlKVlFUSE9BSUI7dGlsZB8pTT1QUlBOQEVGXk9OPU5cQkFQSjwxGipARUFDWDQoHy5DTldAVkxBREBCXj9JO05WTlQ8OzxlW2drYR0tREZOTUtJPDxbRk49KCc2LSsyMCouNzUlKTI4GipMRUpDPSgrMjQxLC8yMzQgJjtOVkhHRz1BXVRAREQ8MSopKy8uMSwhMTksMjIwMyhBRA==
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703526437.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703526437.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703526437.txt bios get version
    3⤵
    PID:4636
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703526437.txt bios get version
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703526437.txt bios get version
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 864
    3⤵
    - Program crash
    PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 1400
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81703526437.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703526437.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703526437.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bedfhaijcd.exe

Filesize
765KB

MD5
e82290bcfe26d591c695ba0a97363ea1

SHA1
71373fe76f71bd683ac5b8e504e4930daec14a77

SHA256
cfaa48253219cd7628b8632d8c6c9e03ff37bb776d86c75dbb9afb6f2ef580b7

SHA512
7ce35e4086ad81f5b44c9a092ff6ff8fa06765c6fd81afca88bb669bba54b78cdbd2537cce0376592bda1a8bc5f0b4b58a756d1681a928442713f9945d1505ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\ZipDLL.dll

Filesize
163KB

MD5
2dc35ddcabcb2b24919b9afae4ec3091

SHA1
9eeed33c3abc656353a7ebd1c66af38cccadd939

SHA256
6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

SHA512
0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\egtabuw.dll

Filesize
166KB

MD5
ab2a34b351e64147a9e4e158d1641bcb

SHA1
2705c0b99f98e910ff6efe8b0dd9679fbeb46387

SHA256
6b4e91c163fb195a85c915ff0effd2083983e86a73551f580bf1f602fa9f9826

SHA512
19c790e834f217fdfc9733610fe8e6fbc5f912510158646fe37031354149336bfb176feb1ea72a6b0dfd0869ea75d0e47388007ac5c044899cbcb599d1c1441e

Download Submit