Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 10:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18d90deda5d72a0690e6ce9edc1287f6.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
18d90deda5d72a0690e6ce9edc1287f6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
18d90deda5d72a0690e6ce9edc1287f6.exe
-
Size
695KB
-
MD5
18d90deda5d72a0690e6ce9edc1287f6
-
SHA1
34146875ac8c90c7ed2adba0199199790bd9850a
-
SHA256
2256dd508b03d6a9d8f69e088371f81c61ac27143409d8a0bfde739ed6b64957
-
SHA512
b72afe9731bb1c6174514d6e9a909a4e0c82dd6a45e177b050560b292b5f268155211c6900cef77b85cf08fe1d10b2588660eadcdf998199baf6cb254ea45761
-
SSDEEP
12288:hrMsWPRnv5cbpi3QXz1RlAuJpUfj9HbZKSKRfOqDiT7fdpAJVsPAELlZj3rK74sc:hruR0nz1RlpG9HbZKSsePEJVsPnDS4sc
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2832 1432026120.exe -
Loads dropped DLL 11 IoCs
pid Process 2392 18d90deda5d72a0690e6ce9edc1287f6.exe 2392 18d90deda5d72a0690e6ce9edc1287f6.exe 2392 18d90deda5d72a0690e6ce9edc1287f6.exe 2392 18d90deda5d72a0690e6ce9edc1287f6.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2984 2832 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2732 wmic.exe Token: SeSecurityPrivilege 2732 wmic.exe Token: SeTakeOwnershipPrivilege 2732 wmic.exe Token: SeLoadDriverPrivilege 2732 wmic.exe Token: SeSystemProfilePrivilege 2732 wmic.exe Token: SeSystemtimePrivilege 2732 wmic.exe Token: SeProfSingleProcessPrivilege 2732 wmic.exe Token: SeIncBasePriorityPrivilege 2732 wmic.exe Token: SeCreatePagefilePrivilege 2732 wmic.exe Token: SeBackupPrivilege 2732 wmic.exe Token: SeRestorePrivilege 2732 wmic.exe Token: SeShutdownPrivilege 2732 wmic.exe Token: SeDebugPrivilege 2732 wmic.exe Token: SeSystemEnvironmentPrivilege 2732 wmic.exe Token: SeRemoteShutdownPrivilege 2732 wmic.exe Token: SeUndockPrivilege 2732 wmic.exe Token: SeManageVolumePrivilege 2732 wmic.exe Token: 33 2732 wmic.exe Token: 34 2732 wmic.exe Token: 35 2732 wmic.exe Token: SeIncreaseQuotaPrivilege 2732 wmic.exe Token: SeSecurityPrivilege 2732 wmic.exe Token: SeTakeOwnershipPrivilege 2732 wmic.exe Token: SeLoadDriverPrivilege 2732 wmic.exe Token: SeSystemProfilePrivilege 2732 wmic.exe Token: SeSystemtimePrivilege 2732 wmic.exe Token: SeProfSingleProcessPrivilege 2732 wmic.exe Token: SeIncBasePriorityPrivilege 2732 wmic.exe Token: SeCreatePagefilePrivilege 2732 wmic.exe Token: SeBackupPrivilege 2732 wmic.exe Token: SeRestorePrivilege 2732 wmic.exe Token: SeShutdownPrivilege 2732 wmic.exe Token: SeDebugPrivilege 2732 wmic.exe Token: SeSystemEnvironmentPrivilege 2732 wmic.exe Token: SeRemoteShutdownPrivilege 2732 wmic.exe Token: SeUndockPrivilege 2732 wmic.exe Token: SeManageVolumePrivilege 2732 wmic.exe Token: 33 2732 wmic.exe Token: 34 2732 wmic.exe Token: 35 2732 wmic.exe Token: SeIncreaseQuotaPrivilege 2972 wmic.exe Token: SeSecurityPrivilege 2972 wmic.exe Token: SeTakeOwnershipPrivilege 2972 wmic.exe Token: SeLoadDriverPrivilege 2972 wmic.exe Token: SeSystemProfilePrivilege 2972 wmic.exe Token: SeSystemtimePrivilege 2972 wmic.exe Token: SeProfSingleProcessPrivilege 2972 wmic.exe Token: SeIncBasePriorityPrivilege 2972 wmic.exe Token: SeCreatePagefilePrivilege 2972 wmic.exe Token: SeBackupPrivilege 2972 wmic.exe Token: SeRestorePrivilege 2972 wmic.exe Token: SeShutdownPrivilege 2972 wmic.exe Token: SeDebugPrivilege 2972 wmic.exe Token: SeSystemEnvironmentPrivilege 2972 wmic.exe Token: SeRemoteShutdownPrivilege 2972 wmic.exe Token: SeUndockPrivilege 2972 wmic.exe Token: SeManageVolumePrivilege 2972 wmic.exe Token: 33 2972 wmic.exe Token: 34 2972 wmic.exe Token: 35 2972 wmic.exe Token: SeIncreaseQuotaPrivilege 1080 wmic.exe Token: SeSecurityPrivilege 1080 wmic.exe Token: SeTakeOwnershipPrivilege 1080 wmic.exe Token: SeLoadDriverPrivilege 1080 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2832 2392 18d90deda5d72a0690e6ce9edc1287f6.exe 28 PID 2392 wrote to memory of 2832 2392 18d90deda5d72a0690e6ce9edc1287f6.exe 28 PID 2392 wrote to memory of 2832 2392 18d90deda5d72a0690e6ce9edc1287f6.exe 28 PID 2392 wrote to memory of 2832 2392 18d90deda5d72a0690e6ce9edc1287f6.exe 28 PID 2832 wrote to memory of 2732 2832 1432026120.exe 29 PID 2832 wrote to memory of 2732 2832 1432026120.exe 29 PID 2832 wrote to memory of 2732 2832 1432026120.exe 29 PID 2832 wrote to memory of 2732 2832 1432026120.exe 29 PID 2832 wrote to memory of 2972 2832 1432026120.exe 32 PID 2832 wrote to memory of 2972 2832 1432026120.exe 32 PID 2832 wrote to memory of 2972 2832 1432026120.exe 32 PID 2832 wrote to memory of 2972 2832 1432026120.exe 32 PID 2832 wrote to memory of 1080 2832 1432026120.exe 34 PID 2832 wrote to memory of 1080 2832 1432026120.exe 34 PID 2832 wrote to memory of 1080 2832 1432026120.exe 34 PID 2832 wrote to memory of 1080 2832 1432026120.exe 34 PID 2832 wrote to memory of 2640 2832 1432026120.exe 36 PID 2832 wrote to memory of 2640 2832 1432026120.exe 36 PID 2832 wrote to memory of 2640 2832 1432026120.exe 36 PID 2832 wrote to memory of 2640 2832 1432026120.exe 36 PID 2832 wrote to memory of 2424 2832 1432026120.exe 38 PID 2832 wrote to memory of 2424 2832 1432026120.exe 38 PID 2832 wrote to memory of 2424 2832 1432026120.exe 38 PID 2832 wrote to memory of 2424 2832 1432026120.exe 38 PID 2832 wrote to memory of 2984 2832 1432026120.exe 40 PID 2832 wrote to memory of 2984 2832 1432026120.exe 40 PID 2832 wrote to memory of 2984 2832 1432026120.exe 40 PID 2832 wrote to memory of 2984 2832 1432026120.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\18d90deda5d72a0690e6ce9edc1287f6.exe"C:\Users\Admin\AppData\Local\Temp\18d90deda5d72a0690e6ce9edc1287f6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\1432026120.exeC:\Users\Admin\AppData\Local\Temp\1432026120.exe 5)1)0)7)0)6)5)9)3)3)2 Kk9JPT0rNCozMB4qUlU7UEM/NC0dLUlEVFBPTEZAQTovIDEwaXJpX2xgcWxcbGU2Ul9kZF5kYxsuREJTTkQ7Oi81MjAyGS89RDs6LR4qT1JIRE8+S1xGQjgxNjI0LRsmUEJQUURSWFVMRzRlcXJrOS8oc2xxJUFCUUYsVEhQJzxHTStHSUVPGS89R0BASEc/PCAoRCs4JC4dLT8xPSYxGio7MDorLB8vPTQ3KCgdLEIwPC0qIClLSUxBUz5TX0lSQ1E4QFY7Gy5QS08+UDpRXENQS0E2IClLSUxBUz5TX0dBR0A0HSxDU0RfTlJGOBcsQlZAXkNGREZERUI6HipHT0xUWT1JTFRRQFE9LiApTz8+S0lUTlVYVUxHNB0sVEg8MhkvPk4oOh0tTVROTUlHQFZUQko+Tk0+SUc8PkJSUEc8IChJTVpJUktSRExFNnRscFwdLFBAU1VLTkNJPlxSUUBRXz1BU040Lx0tQ0hEPlg3LBcsRlFaQ1lHQUdEOlxCTD5RWUlUPz80Y15qbmQgKERJUkVJTD8/XklJPSwsKisuMTMtOCkuLywXLFFHSEQ9KjQtLScwMDAsMiAoRElSRUlMPz9eVEJNPzgsLC43KjEwKjUkLCg3LS41MDMjQUcbJlI+OxsuVUtMN2NrcW0jLmAlK2YfLV1kYnJtLWZibF8zW2JwaW9ucCdjaWgcL2NQcG1UYm1fP2Z0a2pqYGRGYWhcXmJvXV9kcGVvcyApYy8wLTEyKzIsLSkvLzAtJDJfZGlyZWlsX19sYWdhYWBpIi9kYmR0LjYfLl1tIjFfMDksNi0gKTNhIy5jMjA3Ky0cLzNqIDJkKzYzLyoiLzRpJDNdMSVraWxhc15zblptXyAqYU9jZGxhYGUfLS1jZmpgbWFmZR8uW09iZ2hgZ14=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703554562.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703554562.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703554562.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703554562.txt bios get version3⤵PID:2640
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703554562.txt bios get version3⤵PID:2424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:2984
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
1021KB
MD5e2675ad3b571dc8fb03418bcd313caca
SHA147e807e5f99d1fe6efb80ceb1c1446bde3ca8f93
SHA256186f454dbb0b5516f7fe6f4dd2216bf3f35ce206eea061ef00871d2dfa6f65cd
SHA512853d2650b685bee931eb9b4cc9bb5f205707862d3222c42e6a6eaa18d9cd32392085514becd8af40992258356a7e8613cc2eada981b76f2460a26521128b75c4
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
-
Filesize
158KB
MD5704dfc3222f6734fe248d96c42aac826
SHA10348ab95aa6268554f35b9e1c9be3192c6ffa7b8
SHA256416f599582e7d5e1a92938221cb8d7abb93593fea0907ab5884d549a3d5e6818
SHA512e48c9ba9c819ce6c60e48379fb70dec4751c15b30ed3baccd7b376757b47b00c414a4e84cbc1fde83d8d8c7b57f0b1bfe7dc5463a256dd6a99deaae3bef380d0