Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 10:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
163678e33957c8c97d647d6d6cd4716b.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
163678e33957c8c97d647d6d6cd4716b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
163678e33957c8c97d647d6d6cd4716b.exe
-
Size
633KB
-
MD5
163678e33957c8c97d647d6d6cd4716b
-
SHA1
2b9aa1129cf0907bf5c4119bb30760a637544eca
-
SHA256
f0d3cf1646d28ba43be8c3b8e4ea75a6b79dd213bff0d8290f2e87afd51e1a49
-
SHA512
47b143b315f66a71e97c2de6bc4403cf484ecd32d3d21c42f75cb0c22dd30854c9f36d17f49b9005f2b17bf1fadaaba16570db4e2b8f501d7e2df90901a61618
-
SSDEEP
12288:lxLXEJV4XMYQeVt140lfOXNQch/7PS14Hb65D1Tfbrni7aWuZcEJYc0n:lxLIV4XMYh14Eit/7R765D1TfbDgavZ4
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2812 1430730120.exe -
Loads dropped DLL 11 IoCs
pid Process 2392 163678e33957c8c97d647d6d6cd4716b.exe 2392 163678e33957c8c97d647d6d6cd4716b.exe 2392 163678e33957c8c97d647d6d6cd4716b.exe 2392 163678e33957c8c97d647d6d6cd4716b.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 740 2812 WerFault.exe 25 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2976 wmic.exe Token: SeSecurityPrivilege 2976 wmic.exe Token: SeTakeOwnershipPrivilege 2976 wmic.exe Token: SeLoadDriverPrivilege 2976 wmic.exe Token: SeSystemProfilePrivilege 2976 wmic.exe Token: SeSystemtimePrivilege 2976 wmic.exe Token: SeProfSingleProcessPrivilege 2976 wmic.exe Token: SeIncBasePriorityPrivilege 2976 wmic.exe Token: SeCreatePagefilePrivilege 2976 wmic.exe Token: SeBackupPrivilege 2976 wmic.exe Token: SeRestorePrivilege 2976 wmic.exe Token: SeShutdownPrivilege 2976 wmic.exe Token: SeDebugPrivilege 2976 wmic.exe Token: SeSystemEnvironmentPrivilege 2976 wmic.exe Token: SeRemoteShutdownPrivilege 2976 wmic.exe Token: SeUndockPrivilege 2976 wmic.exe Token: SeManageVolumePrivilege 2976 wmic.exe Token: 33 2976 wmic.exe Token: 34 2976 wmic.exe Token: 35 2976 wmic.exe Token: SeIncreaseQuotaPrivilege 2976 wmic.exe Token: SeSecurityPrivilege 2976 wmic.exe Token: SeTakeOwnershipPrivilege 2976 wmic.exe Token: SeLoadDriverPrivilege 2976 wmic.exe Token: SeSystemProfilePrivilege 2976 wmic.exe Token: SeSystemtimePrivilege 2976 wmic.exe Token: SeProfSingleProcessPrivilege 2976 wmic.exe Token: SeIncBasePriorityPrivilege 2976 wmic.exe Token: SeCreatePagefilePrivilege 2976 wmic.exe Token: SeBackupPrivilege 2976 wmic.exe Token: SeRestorePrivilege 2976 wmic.exe Token: SeShutdownPrivilege 2976 wmic.exe Token: SeDebugPrivilege 2976 wmic.exe Token: SeSystemEnvironmentPrivilege 2976 wmic.exe Token: SeRemoteShutdownPrivilege 2976 wmic.exe Token: SeUndockPrivilege 2976 wmic.exe Token: SeManageVolumePrivilege 2976 wmic.exe Token: 33 2976 wmic.exe Token: 34 2976 wmic.exe Token: 35 2976 wmic.exe Token: SeIncreaseQuotaPrivilege 2744 wmic.exe Token: SeSecurityPrivilege 2744 wmic.exe Token: SeTakeOwnershipPrivilege 2744 wmic.exe Token: SeLoadDriverPrivilege 2744 wmic.exe Token: SeSystemProfilePrivilege 2744 wmic.exe Token: SeSystemtimePrivilege 2744 wmic.exe Token: SeProfSingleProcessPrivilege 2744 wmic.exe Token: SeIncBasePriorityPrivilege 2744 wmic.exe Token: SeCreatePagefilePrivilege 2744 wmic.exe Token: SeBackupPrivilege 2744 wmic.exe Token: SeRestorePrivilege 2744 wmic.exe Token: SeShutdownPrivilege 2744 wmic.exe Token: SeDebugPrivilege 2744 wmic.exe Token: SeSystemEnvironmentPrivilege 2744 wmic.exe Token: SeRemoteShutdownPrivilege 2744 wmic.exe Token: SeUndockPrivilege 2744 wmic.exe Token: SeManageVolumePrivilege 2744 wmic.exe Token: 33 2744 wmic.exe Token: 34 2744 wmic.exe Token: 35 2744 wmic.exe Token: SeIncreaseQuotaPrivilege 2744 wmic.exe Token: SeSecurityPrivilege 2744 wmic.exe Token: SeTakeOwnershipPrivilege 2744 wmic.exe Token: SeLoadDriverPrivilege 2744 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2812 2392 163678e33957c8c97d647d6d6cd4716b.exe 25 PID 2392 wrote to memory of 2812 2392 163678e33957c8c97d647d6d6cd4716b.exe 25 PID 2392 wrote to memory of 2812 2392 163678e33957c8c97d647d6d6cd4716b.exe 25 PID 2392 wrote to memory of 2812 2392 163678e33957c8c97d647d6d6cd4716b.exe 25 PID 2812 wrote to memory of 2976 2812 1430730120.exe 23 PID 2812 wrote to memory of 2976 2812 1430730120.exe 23 PID 2812 wrote to memory of 2976 2812 1430730120.exe 23 PID 2812 wrote to memory of 2976 2812 1430730120.exe 23 PID 2812 wrote to memory of 2744 2812 1430730120.exe 39 PID 2812 wrote to memory of 2744 2812 1430730120.exe 39 PID 2812 wrote to memory of 2744 2812 1430730120.exe 39 PID 2812 wrote to memory of 2744 2812 1430730120.exe 39 PID 2812 wrote to memory of 2700 2812 1430730120.exe 33 PID 2812 wrote to memory of 2700 2812 1430730120.exe 33 PID 2812 wrote to memory of 2700 2812 1430730120.exe 33 PID 2812 wrote to memory of 2700 2812 1430730120.exe 33 PID 2812 wrote to memory of 1608 2812 1430730120.exe 36 PID 2812 wrote to memory of 1608 2812 1430730120.exe 36 PID 2812 wrote to memory of 1608 2812 1430730120.exe 36 PID 2812 wrote to memory of 1608 2812 1430730120.exe 36 PID 2812 wrote to memory of 2932 2812 1430730120.exe 38 PID 2812 wrote to memory of 2932 2812 1430730120.exe 38 PID 2812 wrote to memory of 2932 2812 1430730120.exe 38 PID 2812 wrote to memory of 2932 2812 1430730120.exe 38 PID 2812 wrote to memory of 740 2812 1430730120.exe 40 PID 2812 wrote to memory of 740 2812 1430730120.exe 40 PID 2812 wrote to memory of 740 2812 1430730120.exe 40 PID 2812 wrote to memory of 740 2812 1430730120.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\163678e33957c8c97d647d6d6cd4716b.exe"C:\Users\Admin\AppData\Local\Temp\163678e33957c8c97d647d6d6cd4716b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\1430730120.exeC:\Users\Admin\AppData\Local\Temp\1430730120.exe 2\5\8\2\0\0\3\9\8\9\5 LUtBQj0xNiouKhstTk1AUElBNCgXKkxATFVPUkhAPDQsIy0obnJvYWxba2lfaF07UmVmZFleYB4qPEdTVEY7NSkyNSwqHi9DRjs1JxstS0pNRFVAS1dAPzstLjc0Mx0mSzxNVEBKXVVSSTRga29uNSctc3JzJTw8TkkoTE1QLT5HSCVETEFHHi9DSUA7QkRCOBgtRDE6JCkXKkItNSsxICw7KzQoLxsnQjQ9KigYJj8zOCUvIC9NSUc7UEFPV05SSVM4O1A4HipIUE9EUjpMVkBTRzk7IC9NSUc7UEFPV0xBTUI0GCZAVkBXU1JMOhcnPFNDWjtLRExGRT00Gy1DR1FUXz9JR05OQ001MyAvUT85RUZXSk1dVVJJNBgmUUs4Kh4vRFAoNRcqUFBGUklNQlZPPEdBSkVDSU0+Pj1MTUo4GC1JU1xJTUVPR0g9O3RyclwYJk1DT01QTklLPldMTkNNV0JBWVA0KhcqRkQ8Q1g9LhcnQE5dP1FMQU1GOlc8SUFNUU5URUE0XlhncWAYLURPVEVERjxCWkFOPTc2JSkpLywsKTEuMi8sGCZPR0g9OzE0MCcvKi43MyoeL0RMTkZDSj8/V1JJTUI0LSYvLS0oLzUqLicyJzE4LSooQU0dJk04OB4qTVBMPWVrbGcgMVwdMGYlL11fXG9wKV5nbGU1W11qZnJqaCxjb2ocKl1Nc2lMZ21lQWZvZWdtXFxLYW5eXl1pWmJgaGpveSIpXiktMC0qMDIyLykqKS0wICpkZG90ZWRmXGJoWWxhZ2JpHSlhZWBsMzYlMF1oHC5iLDExNjMiKS5bIDFfKjU3MS8cKi1nIy5cMDY5MSodKTFsICtiMSttaWdbcGFvZl9tZSIqXElgZ2hZZWUlLy1eYGdjaVlrZSUwW0pcZGtcX2M=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703549321.txt bios get version3⤵PID:2700
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703549321.txt bios get version3⤵PID:1608
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703549321.txt bios get version3⤵PID:2932
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703549321.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:740
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703549321.txt bios get serialnumber1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2976