Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 23:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42fd8824660d78eb5e83a7bb06e8734e.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
42fd8824660d78eb5e83a7bb06e8734e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
42fd8824660d78eb5e83a7bb06e8734e.exe
-
Size
597KB
-
MD5
42fd8824660d78eb5e83a7bb06e8734e
-
SHA1
d36cbdb562f2f105593c7b9fb94f0ab7a15c06a3
-
SHA256
162ffc95c2850ff8f29113cd945da4044cf51ef6109bb7fd3b2e81032f101963
-
SHA512
bf94388eae3bb9857e370d0dca399a5ff65c964859e75e6e4ae2e2872af666a247f32e2f6070f567632b1d938c80118f583f3abf5d1220dcccdf1fd389ddf4b9
-
SSDEEP
12288:p5sqqXM/J3WHOtzx0thPuclKDIrr85yEa0NkCeY3v9t:p5LEkM9uclKcroyEaoP/vT
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2404 dcgcabfhicbb.exe -
Loads dropped DLL 10 IoCs
pid Process 2316 42fd8824660d78eb5e83a7bb06e8734e.exe 2316 42fd8824660d78eb5e83a7bb06e8734e.exe 2316 42fd8824660d78eb5e83a7bb06e8734e.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2960 2404 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2824 wmic.exe Token: SeSecurityPrivilege 2824 wmic.exe Token: SeTakeOwnershipPrivilege 2824 wmic.exe Token: SeLoadDriverPrivilege 2824 wmic.exe Token: SeSystemProfilePrivilege 2824 wmic.exe Token: SeSystemtimePrivilege 2824 wmic.exe Token: SeProfSingleProcessPrivilege 2824 wmic.exe Token: SeIncBasePriorityPrivilege 2824 wmic.exe Token: SeCreatePagefilePrivilege 2824 wmic.exe Token: SeBackupPrivilege 2824 wmic.exe Token: SeRestorePrivilege 2824 wmic.exe Token: SeShutdownPrivilege 2824 wmic.exe Token: SeDebugPrivilege 2824 wmic.exe Token: SeSystemEnvironmentPrivilege 2824 wmic.exe Token: SeRemoteShutdownPrivilege 2824 wmic.exe Token: SeUndockPrivilege 2824 wmic.exe Token: SeManageVolumePrivilege 2824 wmic.exe Token: 33 2824 wmic.exe Token: 34 2824 wmic.exe Token: 35 2824 wmic.exe Token: SeIncreaseQuotaPrivilege 2824 wmic.exe Token: SeSecurityPrivilege 2824 wmic.exe Token: SeTakeOwnershipPrivilege 2824 wmic.exe Token: SeLoadDriverPrivilege 2824 wmic.exe Token: SeSystemProfilePrivilege 2824 wmic.exe Token: SeSystemtimePrivilege 2824 wmic.exe Token: SeProfSingleProcessPrivilege 2824 wmic.exe Token: SeIncBasePriorityPrivilege 2824 wmic.exe Token: SeCreatePagefilePrivilege 2824 wmic.exe Token: SeBackupPrivilege 2824 wmic.exe Token: SeRestorePrivilege 2824 wmic.exe Token: SeShutdownPrivilege 2824 wmic.exe Token: SeDebugPrivilege 2824 wmic.exe Token: SeSystemEnvironmentPrivilege 2824 wmic.exe Token: SeRemoteShutdownPrivilege 2824 wmic.exe Token: SeUndockPrivilege 2824 wmic.exe Token: SeManageVolumePrivilege 2824 wmic.exe Token: 33 2824 wmic.exe Token: 34 2824 wmic.exe Token: 35 2824 wmic.exe Token: SeIncreaseQuotaPrivilege 2892 wmic.exe Token: SeSecurityPrivilege 2892 wmic.exe Token: SeTakeOwnershipPrivilege 2892 wmic.exe Token: SeLoadDriverPrivilege 2892 wmic.exe Token: SeSystemProfilePrivilege 2892 wmic.exe Token: SeSystemtimePrivilege 2892 wmic.exe Token: SeProfSingleProcessPrivilege 2892 wmic.exe Token: SeIncBasePriorityPrivilege 2892 wmic.exe Token: SeCreatePagefilePrivilege 2892 wmic.exe Token: SeBackupPrivilege 2892 wmic.exe Token: SeRestorePrivilege 2892 wmic.exe Token: SeShutdownPrivilege 2892 wmic.exe Token: SeDebugPrivilege 2892 wmic.exe Token: SeSystemEnvironmentPrivilege 2892 wmic.exe Token: SeRemoteShutdownPrivilege 2892 wmic.exe Token: SeUndockPrivilege 2892 wmic.exe Token: SeManageVolumePrivilege 2892 wmic.exe Token: 33 2892 wmic.exe Token: 34 2892 wmic.exe Token: 35 2892 wmic.exe Token: SeIncreaseQuotaPrivilege 2748 wmic.exe Token: SeSecurityPrivilege 2748 wmic.exe Token: SeTakeOwnershipPrivilege 2748 wmic.exe Token: SeLoadDriverPrivilege 2748 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2404 2316 42fd8824660d78eb5e83a7bb06e8734e.exe 28 PID 2316 wrote to memory of 2404 2316 42fd8824660d78eb5e83a7bb06e8734e.exe 28 PID 2316 wrote to memory of 2404 2316 42fd8824660d78eb5e83a7bb06e8734e.exe 28 PID 2316 wrote to memory of 2404 2316 42fd8824660d78eb5e83a7bb06e8734e.exe 28 PID 2404 wrote to memory of 2824 2404 dcgcabfhicbb.exe 19 PID 2404 wrote to memory of 2824 2404 dcgcabfhicbb.exe 19 PID 2404 wrote to memory of 2824 2404 dcgcabfhicbb.exe 19 PID 2404 wrote to memory of 2824 2404 dcgcabfhicbb.exe 19 PID 2404 wrote to memory of 2892 2404 dcgcabfhicbb.exe 27 PID 2404 wrote to memory of 2892 2404 dcgcabfhicbb.exe 27 PID 2404 wrote to memory of 2892 2404 dcgcabfhicbb.exe 27 PID 2404 wrote to memory of 2892 2404 dcgcabfhicbb.exe 27 PID 2404 wrote to memory of 2748 2404 dcgcabfhicbb.exe 25 PID 2404 wrote to memory of 2748 2404 dcgcabfhicbb.exe 25 PID 2404 wrote to memory of 2748 2404 dcgcabfhicbb.exe 25 PID 2404 wrote to memory of 2748 2404 dcgcabfhicbb.exe 25 PID 2404 wrote to memory of 2616 2404 dcgcabfhicbb.exe 24 PID 2404 wrote to memory of 2616 2404 dcgcabfhicbb.exe 24 PID 2404 wrote to memory of 2616 2404 dcgcabfhicbb.exe 24 PID 2404 wrote to memory of 2616 2404 dcgcabfhicbb.exe 24 PID 2404 wrote to memory of 1300 2404 dcgcabfhicbb.exe 22 PID 2404 wrote to memory of 1300 2404 dcgcabfhicbb.exe 22 PID 2404 wrote to memory of 1300 2404 dcgcabfhicbb.exe 22 PID 2404 wrote to memory of 1300 2404 dcgcabfhicbb.exe 22 PID 2404 wrote to memory of 2960 2404 dcgcabfhicbb.exe 35 PID 2404 wrote to memory of 2960 2404 dcgcabfhicbb.exe 35 PID 2404 wrote to memory of 2960 2404 dcgcabfhicbb.exe 35 PID 2404 wrote to memory of 2960 2404 dcgcabfhicbb.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\42fd8824660d78eb5e83a7bb06e8734e.exe"C:\Users\Admin\AppData\Local\Temp\42fd8824660d78eb5e83a7bb06e8734e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\dcgcabfhicbb.exeC:\Users\Admin\AppData\Local\Temp\dcgcabfhicbb.exe 7-5-2-4-6-9-2-9-7-9-6 KEtHQDcoNywyLRooTlM+SkBCNCkXKUdAUlNJSUlAPTQrGSpCRU1LRzs2KS8xLDUcKTpHOzYnGihLUEs+TEFLWEA+Ni0yNTMvHiZMPExPQFBbT0lKNGFrbmk1LSttaXQlPTxNRChSS0okP0dJJUNHQU0cKTpKQDxCQz04His+KDskKhcpPS07KSsXLTssNCcqGy1ALjQrKBkmPi44Ky0aJk5JSDtPPE9dTExAVDg8UDcZKk5OSTtTOk1WP05HPzkaJk5JSDtPPE9dSjtEQzRPQz0eLS5JX1tnWB4pKklnX3VfaSMpKSkoKik0XRomQ08+Vk9LRzscKTxWPFg6Rz1HR0o/NB4mQUZNTVpATklOUTxLNCwZKlJEO0VJUEhMWU5NSjkaJlRENikaKD9RLTcXLUlORU5CSENbUTxKOkhEP0JIP0M/TFBDNhcpQk5dTk9FUkBGPDdtbXNhGiZQPE1MTEdETENZTFE8S1Y+OlRROSwXLT9COz9ROC8cKUBRVj1QSDpIRz9ZPEw6S1BKTUBCOWBYampeFyk9SlVKRkY/O1hASjYsLzQoKDUpJyoqJzIxHClLR0Q+NCstLTUvMSo0JzEXKT1KVUpGRj87WEtDRkA7LykpNCYrJysuJS8uNCsuMSkvJElI2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:2960
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703634180.txt bios get serialnumber1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703634180.txt bios get version1⤵PID:1300
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703634180.txt bios get version1⤵PID:2616
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703634180.txt bios get version1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703634180.txt bios get version1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892