6a7c0b84c8dfa7d04aed0c41b510dade41ad81148e13b346e9508dfb87f24e51

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12c634a846f7253bd6e87f7b08ebf789.exe
Size

574KB
MD5

12c634a846f7253bd6e87f7b08ebf789
SHA1

17a448d77d66b81404527b57ba8c2cbd52b66142
SHA256

6a7c0b84c8dfa7d04aed0c41b510dade41ad81148e13b346e9508dfb87f24e51
SHA512

5456442bd389f68aef0ef4c7c6e1472adaa51f5dabcbdb482f741106c018bf2a42e9829bbea75f4f06616e7b4a7328e591c5914813f2582fe2c649ecd87bffb7
SSDEEP

12288:a4Sc5f0V5iPd5lAurV6EGEEfSxoapDe3buf+RZjNKYpYz2qL:a2f9HlVrV6EPpmPfA1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2380	bbjcabfdcbab.exe

Loads dropped DLL 10 IoCs

pid	Process
2324	12c634a846f7253bd6e87f7b08ebf789.exe
2324	12c634a846f7253bd6e87f7b08ebf789.exe
2324	12c634a846f7253bd6e87f7b08ebf789.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	2380	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1128	wmic.exe
Token: SeSecurityPrivilege	1128	wmic.exe
Token: SeTakeOwnershipPrivilege	1128	wmic.exe
Token: SeLoadDriverPrivilege	1128	wmic.exe
Token: SeSystemProfilePrivilege	1128	wmic.exe
Token: SeSystemtimePrivilege	1128	wmic.exe
Token: SeProfSingleProcessPrivilege	1128	wmic.exe
Token: SeIncBasePriorityPrivilege	1128	wmic.exe
Token: SeCreatePagefilePrivilege	1128	wmic.exe
Token: SeBackupPrivilege	1128	wmic.exe
Token: SeRestorePrivilege	1128	wmic.exe
Token: SeShutdownPrivilege	1128	wmic.exe
Token: SeDebugPrivilege	1128	wmic.exe
Token: SeSystemEnvironmentPrivilege	1128	wmic.exe
Token: SeRemoteShutdownPrivilege	1128	wmic.exe
Token: SeUndockPrivilege	1128	wmic.exe
Token: SeManageVolumePrivilege	1128	wmic.exe
Token: 33	1128	wmic.exe
Token: 34	1128	wmic.exe
Token: 35	1128	wmic.exe
Token: SeIncreaseQuotaPrivilege	1128	wmic.exe
Token: SeSecurityPrivilege	1128	wmic.exe
Token: SeTakeOwnershipPrivilege	1128	wmic.exe
Token: SeLoadDriverPrivilege	1128	wmic.exe
Token: SeSystemProfilePrivilege	1128	wmic.exe
Token: SeSystemtimePrivilege	1128	wmic.exe
Token: SeProfSingleProcessPrivilege	1128	wmic.exe
Token: SeIncBasePriorityPrivilege	1128	wmic.exe
Token: SeCreatePagefilePrivilege	1128	wmic.exe
Token: SeBackupPrivilege	1128	wmic.exe
Token: SeRestorePrivilege	1128	wmic.exe
Token: SeShutdownPrivilege	1128	wmic.exe
Token: SeDebugPrivilege	1128	wmic.exe
Token: SeSystemEnvironmentPrivilege	1128	wmic.exe
Token: SeRemoteShutdownPrivilege	1128	wmic.exe
Token: SeUndockPrivilege	1128	wmic.exe
Token: SeManageVolumePrivilege	1128	wmic.exe
Token: 33	1128	wmic.exe
Token: 34	1128	wmic.exe
Token: 35	1128	wmic.exe
Token: SeIncreaseQuotaPrivilege	2612	wmic.exe
Token: SeSecurityPrivilege	2612	wmic.exe
Token: SeTakeOwnershipPrivilege	2612	wmic.exe
Token: SeLoadDriverPrivilege	2612	wmic.exe
Token: SeSystemProfilePrivilege	2612	wmic.exe
Token: SeSystemtimePrivilege	2612	wmic.exe
Token: SeProfSingleProcessPrivilege	2612	wmic.exe
Token: SeIncBasePriorityPrivilege	2612	wmic.exe
Token: SeCreatePagefilePrivilege	2612	wmic.exe
Token: SeBackupPrivilege	2612	wmic.exe
Token: SeRestorePrivilege	2612	wmic.exe
Token: SeShutdownPrivilege	2612	wmic.exe
Token: SeDebugPrivilege	2612	wmic.exe
Token: SeSystemEnvironmentPrivilege	2612	wmic.exe
Token: SeRemoteShutdownPrivilege	2612	wmic.exe
Token: SeUndockPrivilege	2612	wmic.exe
Token: SeManageVolumePrivilege	2612	wmic.exe
Token: 33	2612	wmic.exe
Token: 34	2612	wmic.exe
Token: 35	2612	wmic.exe
Token: SeIncreaseQuotaPrivilege	2612	wmic.exe
Token: SeSecurityPrivilege	2612	wmic.exe
Token: SeTakeOwnershipPrivilege	2612	wmic.exe
Token: SeLoadDriverPrivilege	2612	wmic.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2380	2324	12c634a846f7253bd6e87f7b08ebf789.exe	28
PID 2324 wrote to memory of 2380	2324	12c634a846f7253bd6e87f7b08ebf789.exe	28
PID 2324 wrote to memory of 2380	2324	12c634a846f7253bd6e87f7b08ebf789.exe	28
PID 2324 wrote to memory of 2380	2324	12c634a846f7253bd6e87f7b08ebf789.exe	28
PID 2324 wrote to memory of 2380	2324	12c634a846f7253bd6e87f7b08ebf789.exe	28
PID 2324 wrote to memory of 2380	2324	12c634a846f7253bd6e87f7b08ebf789.exe	28
PID 2324 wrote to memory of 2380	2324	12c634a846f7253bd6e87f7b08ebf789.exe	28
PID 2380 wrote to memory of 1128	2380	bbjcabfdcbab.exe	29
PID 2380 wrote to memory of 1128	2380	bbjcabfdcbab.exe	29
PID 2380 wrote to memory of 1128	2380	bbjcabfdcbab.exe	29
PID 2380 wrote to memory of 1128	2380	bbjcabfdcbab.exe	29
PID 2380 wrote to memory of 2612	2380	bbjcabfdcbab.exe	33
PID 2380 wrote to memory of 2612	2380	bbjcabfdcbab.exe	33
PID 2380 wrote to memory of 2612	2380	bbjcabfdcbab.exe	33
PID 2380 wrote to memory of 2612	2380	bbjcabfdcbab.exe	33
PID 2380 wrote to memory of 2720	2380	bbjcabfdcbab.exe	35
PID 2380 wrote to memory of 2720	2380	bbjcabfdcbab.exe	35
PID 2380 wrote to memory of 2720	2380	bbjcabfdcbab.exe	35
PID 2380 wrote to memory of 2720	2380	bbjcabfdcbab.exe	35
PID 2380 wrote to memory of 2592	2380	bbjcabfdcbab.exe	37
PID 2380 wrote to memory of 2592	2380	bbjcabfdcbab.exe	37
PID 2380 wrote to memory of 2592	2380	bbjcabfdcbab.exe	37
PID 2380 wrote to memory of 2592	2380	bbjcabfdcbab.exe	37
PID 2380 wrote to memory of 2456	2380	bbjcabfdcbab.exe	38
PID 2380 wrote to memory of 2456	2380	bbjcabfdcbab.exe	38
PID 2380 wrote to memory of 2456	2380	bbjcabfdcbab.exe	38
PID 2380 wrote to memory of 2456	2380	bbjcabfdcbab.exe	38
PID 2380 wrote to memory of 1936	2380	bbjcabfdcbab.exe	40
PID 2380 wrote to memory of 1936	2380	bbjcabfdcbab.exe	40
PID 2380 wrote to memory of 1936	2380	bbjcabfdcbab.exe	40
PID 2380 wrote to memory of 1936	2380	bbjcabfdcbab.exe	40

C:\Users\Admin\AppData\Local\Temp\12c634a846f7253bd6e87f7b08ebf789.exe
"C:\Users\Admin\AppData\Local\Temp\12c634a846f7253bd6e87f7b08ebf789.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\bbjcabfdcbab.exe
  C:\Users\Admin\AppData\Local\Temp\bbjcabfdcbab.exe 1-5-7-0-8-7-1-9-4-9-0 LktCRDUqOCgwKCAuTk5CSEJDNCwXL01ATVdHS0pAQDQxHyo9SUtNSDs5KTUxMTIgJzxIOzknIC5LS088TkJLW0BEPC0tNCspHyZPPFJVQEtfTUtLNGRrdG81KC9rXnFtKmtoZChacGgmY1hwWC5oaV9vGChCQ0U6S0g/NndBRVA6S0xCQi5LTE1ARz9DJ0VLMEJDTRkuOy00LTAbKEQqNiwoHCZEMjgmMRgoQys5JDEfKj01NSYwFytHUk4/TkNMWE9JRU1BQlQ2ICdJUUZATENTWj5VRDo8FytHUk4/TkNMWE04STw9Hyo+WD1YVElINCAuQFFFVzxMO0hATkQ4GS9ASFJLWzlSTlJMRUo2MRcrS0hASURZR05eTE5DPR8qT001Kx8mQEoxPBsoUk1HU0BJPF9WQEVDR0ZEQEk4R0RQS0w1GS5AT1ZSVElNSUU+PGtubGUfKktFTE5RRUVFR15QTEVKWEM4VUo9MRsoSEE9RE85KCAuRExfPFJNOElAQ15AR0NKUk9LQTs9ZVxlc10ZLjtLTk5LSjpEV0JPNDEnLjgxJzYqJzEqNBcvU0RGRTUqMyktLTg0NC85GChDRlNFTE48PV9MQkw8OSgvMDQoMigqNCEwMTQ1NSk5IklM
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703699759.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1128
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703699759.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703699759.txt bios get version
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703699759.txt bios get version
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703699759.txt bios get version
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 368
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81703699759.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703699759.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703699759.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit
\Users\Admin\AppData\Local\Temp\bbjcabfdcbab.exe

Filesize
826KB

MD5
2ab0333790a95b821222751ce02dab0a

SHA1
34a2defd477caadc28e2da9456b44cd39d7dfbb3

SHA256
8575f9dabe7f329eff05efe241b5e1cef200ceebeb7f3567c30b9ba6f50fb107

SHA512
76ed284b8ec1b354e9323a774c5cdb515661e672b7904bce01bb5cf54b29dc287cbe50b82c58e59062f76bd707e2a430668462cdb8749b2d3814e8b3e72bf566

Download Submit
\Users\Admin\AppData\Local\Temp\bbjcabfdcbab.exe

Filesize
729KB

MD5
fed1ba3db1dea0b84f95f8ba24462e12

SHA1
f9965bb52a73ebd9106b82665af1cbb8b262ca0f

SHA256
35038abe58754c1c3fb7e123ccd7560d56630bb080ba28273d0aa33e240d2757

SHA512
3d5d4fcc71cc50ed153bc5e7534dcbf7c3bf9e8520c4738633067b52548b4643e63d6128be02733121c9f51579cabb59161493f5c1b196a6b5222e0a23f6a7a1

Download Submit
\Users\Admin\AppData\Local\Temp\bbjcabfdcbab.exe

Filesize
576KB

MD5
712e3007731ea97ffd71e1d628633c2a

SHA1
5eeaa0d2429f3376faf40801d9864be7d160a18b

SHA256
5da9a4acf14f80460fa3b1412e97149d8fdf9dadec1c5ce244a68cca6526782c

SHA512
51740f4cd5e1de3c555814b36199b6e6523e8335fa9f013cee6f72141449db67639fbc3ec9f09fdb6e4bb40c807e3fdca664ee6c8798a0e28be39420b2234399

Download Submit
\Users\Admin\AppData\Local\Temp\bbjcabfdcbab.exe

Filesize
507KB

MD5
8051fb98228c8b6646fd9613c1a6a5d5

SHA1
e59f19b34b11b517248d273a8ddceaae63c7c812

SHA256
19f2d1f847ee1f8bb2341b9e9e4d199acbe3974de26a61d15289f3f721f2647a

SHA512
5058974043df058b2bff5ac926921b450815542bc643330876e00cf7bf0f78dd01a806d1ff4644c9e343babf7466f03e7149b4ef995efa191495ae2dea1560be

Download Submit
\Users\Admin\AppData\Local\Temp\bbjcabfdcbab.exe

Filesize
614KB

MD5
50d028fbe4e0ae6f60a21ee02c7720b4

SHA1
8009cff25a9570939e55fab56181bedb0a2788bf

SHA256
3d19eb3c349f7082a4fb8362d9595c31d326f61470598f3241f61643aa51c812

SHA512
655b809a4633c8cdf1308164b442aceece6086ae823aefbd197282be2b63d8a974f855206273cbd050ca8204db5c33d14431b923be9f434c7327b532818855de

Download Submit
\Users\Admin\AppData\Local\Temp\bbjcabfdcbab.exe

Filesize
539KB

MD5
e0f4205961730b76a1bb28519c650c74

SHA1
48e16d4e7eb167278607a6a621eddc7dbd70bb92

SHA256
16a7feb75419d2ead105357efa8f16e5aa3e0a80b0080984681891c590fe07a5

SHA512
eb53cf43b64cdee547a33bc5483f61d2e9e66dda5867e256dff16efe6d008aa52e1b1daa287e447890154e8b5d7c1a5544987c3fa8c8fceda4d7c4204362e78e

Download Submit
\Users\Admin\AppData\Local\Temp\bbjcabfdcbab.exe

Filesize
616KB

MD5
c3e77f60a8e1b560354dbe75dd1687f2

SHA1
2321cbb0ecd48b2cdc5cbc4047b5ec7216602b4b

SHA256
e20f0e820d02e490cd4c5313aec7f7fe6e0fea3d75b69d21bb1d86f097dd16c4

SHA512
dcf1e5f4469955e3a3ce9c9cbe1ccd945b1d631e594ef9808ec0a9de6e8abc14485fc19b2f819ff513a15c7a4c1f9d260ada3f1d332fcb891b824051b3de91e7

Download Submit
\Users\Admin\AppData\Local\Temp\bbjcabfdcbab.exe

Filesize
699KB

MD5
ec26851dca2bed002d06eaa88ec6396d

SHA1
57d3f6402d819282859a397b77fea6fa8c3245a2

SHA256
a9155e6be87a9f863247a514dd20b91abdea74510bc25b7ae85bddc239b5a17a

SHA512
68571035f9e7f721991c8a631e3e2a4d64e38fd54e08a9372ceadd47531396961fc9bc4c20037d7019d9d83292faab62c3c14484be060e8d852b2765f9749e30

Download Submit
\Users\Admin\AppData\Local\Temp\nsi147B.tmp\moo.dll

Filesize
108KB

MD5
076a3050150c1887d9a5ef76762ff4a4

SHA1
225adac93a9de5af6ca5646cdaf66c69c821dee4

SHA256
72d94ff0e7b385b21bb5f103f055602b67e3e805408d81859fe5ec93a1dc2c2b

SHA512
66be5077dc0380232f5033f101447c08ae0f8c9b5768b2c3a5ecca9b33d4d3932dc4d5fe4167021736884111ef57f1839bd3525ba04968917591f71ee65ac0c8

Download Submit
\Users\Admin\AppData\Local\Temp\nsi147B.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit