11ba4bb45bf8b6ca4f1e4d3fc6740912385ef3ca587b5e482e720cc7bf7a94bc

Analysis

max time kernel
0s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1264851a7dfc2ac1c4a21132646a279b.exe
Size

975KB
MD5

1264851a7dfc2ac1c4a21132646a279b
SHA1

679a364d6366bd86d12fc3ca252595c13d10694e
SHA256

11ba4bb45bf8b6ca4f1e4d3fc6740912385ef3ca587b5e482e720cc7bf7a94bc
SHA512

d14bd7ca1c6e09d936567d543ab4c54c6c28b889cc210b5144e596f7b7397b6fa127485b4062cdd791d3003e8b46904c1288d26a371f99be2bdb829863f12d67
SSDEEP

24576:loheA/Lz7PFVke3dv6FfajLAf0DmKbfKy5mZr:uheA/LPPFVk0vy6EcDLyyEZr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3924	f.exe

Loads dropped DLL 1 IoCs

pid	Process
3596	1264851a7dfc2ac1c4a21132646a279b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
5112	3924	WerFault.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version\ = "1.0"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\ = "SmartInstallerLib"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\ = "CBrowserExternal Class"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe\""	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Programmable	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS\ = "0"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib	f.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2024	wmic.exe
Token: SeSecurityPrivilege	2024	wmic.exe
Token: SeTakeOwnershipPrivilege	2024	wmic.exe
Token: SeLoadDriverPrivilege	2024	wmic.exe
Token: SeSystemProfilePrivilege	2024	wmic.exe
Token: SeSystemtimePrivilege	2024	wmic.exe
Token: SeProfSingleProcessPrivilege	2024	wmic.exe
Token: SeIncBasePriorityPrivilege	2024	wmic.exe
Token: SeCreatePagefilePrivilege	2024	wmic.exe
Token: SeBackupPrivilege	2024	wmic.exe
Token: SeRestorePrivilege	2024	wmic.exe
Token: SeShutdownPrivilege	2024	wmic.exe
Token: SeDebugPrivilege	2024	wmic.exe
Token: SeSystemEnvironmentPrivilege	2024	wmic.exe
Token: SeRemoteShutdownPrivilege	2024	wmic.exe
Token: SeUndockPrivilege	2024	wmic.exe
Token: SeManageVolumePrivilege	2024	wmic.exe
Token: 33	2024	wmic.exe
Token: 34	2024	wmic.exe
Token: 35	2024	wmic.exe
Token: 36	2024	wmic.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 3924	3596	1264851a7dfc2ac1c4a21132646a279b.exe	32
PID 3596 wrote to memory of 3924	3596	1264851a7dfc2ac1c4a21132646a279b.exe	32
PID 3596 wrote to memory of 3924	3596	1264851a7dfc2ac1c4a21132646a279b.exe	32
PID 3924 wrote to memory of 2024	3924	f.exe	19
PID 3924 wrote to memory of 2024	3924	f.exe	19
PID 3924 wrote to memory of 2024	3924	f.exe	19

C:\Users\Admin\AppData\Local\Temp\1264851a7dfc2ac1c4a21132646a279b.exe
"C:\Users\Admin\AppData\Local\Temp\1264851a7dfc2ac1c4a21132646a279b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\f.exe
  C:\Users\Admin\AppData\Local\Temp\f.exe /PID=3005 /SUBPID=0 /DISTID=1775 /NETWORKID=0 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=a045507d1dda655e7a4bc4d4a3e2af02 /D1=24131 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=2
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3924

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get serialnumber
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3924 -ip 3924
1⤵
PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 896
1⤵
- Program crash
PID:5112

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
1⤵
PID:3532

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
1⤵
PID:1492

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f.exe

Filesize
8KB

MD5
a8216fac21cb9ba77696a0de3a802380

SHA1
6d7524d3a8ae3fbfc6cbdf00fc752d2de7404ab0

SHA256
ef3ae79aa15a5b06fa3d505eb11a4bece7d3dc1542e1444f80c911d9d5208d34

SHA512
2ff91a679870fbae74515425d700cf3b51dbf26abd2dd998342416c46fbceff6d750bb3173b151e7ae05d030986f457841dc40c938c5d664838608dad57d4f86

Download Submit
C:\Users\Admin\AppData\Local\Temp\f.exe

Filesize
1KB

MD5
46ee25f0dcf4ce8558a4cfb32d9ef4bd

SHA1
280a98f8267468f3955cff388f8ba2721db72ee9

SHA256
b3d610b475064f61dd6d90fb0bae04ca6e6d23902533d0ae7e53cb5a386b64e1

SHA512
772b904387273ae79f536feec9d93751d7b424d27adb63b0f2586022494a88ddc704216dcbe9692d4f4a0999cf7c63a18e0517af1c1f733f451cba0cf7900849

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq3BE1.tmp\Convert.dll

Filesize
114KB

MD5
00321d477f76e401373c1fc71c7c4502

SHA1
cb010222cb25d67810f46d20c4daffea60b86c6e

SHA256
48db77073c6ab1ab2a0f0d80a21d1a17bee5ed745735b2a780b137bf06681c43

SHA512
6974617a9482b08f41db8575e123f82d76c18ae8dc2aae605b6d3bee0dce52f55de061283ca4c3eb0579eeaa0261f09cb98c611b0b5d502b37b3169e0bba4f85

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq3BE1.tmp\Convert.dll

Filesize
28KB

MD5
7c32ce4dccd8655426fdd5bf7eedb1ad

SHA1
8f69dba0e8df626e7df25d3ff5b73fc12cf08243

SHA256
dd8f4900cf542f3e2b564d34051bbae1ff91c6d8d695415ce2e57ef841d7dc6b

SHA512
c168b4910d1abd4b350b88cf8dc4fab45be822a2611d46dcec50cac471f5adee909372485ab4163642fc53a04290fd2028e1f65a0d2c3b429b699f0627a46430

Download Submit
C:\Users\Admin\AppData\Local\Temp\obhhelper.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\obhhelper.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit