Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ddfd1c0c9106b7ea7e2bc795f11aebd.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4ddfd1c0c9106b7ea7e2bc795f11aebd.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
4ddfd1c0c9106b7ea7e2bc795f11aebd.exe
-
Size
648KB
-
MD5
4ddfd1c0c9106b7ea7e2bc795f11aebd
-
SHA1
d037679416515d183c43ab376b693821bad86e9a
-
SHA256
211fd2c8b55e5e54803a31a896ec02be8e9069cd409ab23394269163c574c445
-
SHA512
f9d62642c3705486b5652ee9998100b6fd23aa84f0a41d0862b54510fc815cc6f487f475b12fff7256d9244064032bd2d2fa9e2c8af33311651315168b62f9ba
-
SSDEEP
12288:uqQlkqusypbvVixhHQNMyTjApD4izvymAGtMa5cyUaBavn7UCnafc8vy4hl:uqjtsypbdVMyT0OiSUc4G386c
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3740 bedhefifca.exe -
Loads dropped DLL 2 IoCs
pid Process 2332 4ddfd1c0c9106b7ea7e2bc795f11aebd.exe 2332 4ddfd1c0c9106b7ea7e2bc795f11aebd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3452 3740 WerFault.exe 24 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4572 wmic.exe Token: SeSecurityPrivilege 4572 wmic.exe Token: SeTakeOwnershipPrivilege 4572 wmic.exe Token: SeLoadDriverPrivilege 4572 wmic.exe Token: SeSystemProfilePrivilege 4572 wmic.exe Token: SeSystemtimePrivilege 4572 wmic.exe Token: SeProfSingleProcessPrivilege 4572 wmic.exe Token: SeIncBasePriorityPrivilege 4572 wmic.exe Token: SeCreatePagefilePrivilege 4572 wmic.exe Token: SeBackupPrivilege 4572 wmic.exe Token: SeRestorePrivilege 4572 wmic.exe Token: SeShutdownPrivilege 4572 wmic.exe Token: SeDebugPrivilege 4572 wmic.exe Token: SeSystemEnvironmentPrivilege 4572 wmic.exe Token: SeRemoteShutdownPrivilege 4572 wmic.exe Token: SeUndockPrivilege 4572 wmic.exe Token: SeManageVolumePrivilege 4572 wmic.exe Token: 33 4572 wmic.exe Token: 34 4572 wmic.exe Token: 35 4572 wmic.exe Token: 36 4572 wmic.exe Token: SeIncreaseQuotaPrivilege 4572 wmic.exe Token: SeSecurityPrivilege 4572 wmic.exe Token: SeTakeOwnershipPrivilege 4572 wmic.exe Token: SeLoadDriverPrivilege 4572 wmic.exe Token: SeSystemProfilePrivilege 4572 wmic.exe Token: SeSystemtimePrivilege 4572 wmic.exe Token: SeProfSingleProcessPrivilege 4572 wmic.exe Token: SeIncBasePriorityPrivilege 4572 wmic.exe Token: SeCreatePagefilePrivilege 4572 wmic.exe Token: SeBackupPrivilege 4572 wmic.exe Token: SeRestorePrivilege 4572 wmic.exe Token: SeShutdownPrivilege 4572 wmic.exe Token: SeDebugPrivilege 4572 wmic.exe Token: SeSystemEnvironmentPrivilege 4572 wmic.exe Token: SeRemoteShutdownPrivilege 4572 wmic.exe Token: SeUndockPrivilege 4572 wmic.exe Token: SeManageVolumePrivilege 4572 wmic.exe Token: 33 4572 wmic.exe Token: 34 4572 wmic.exe Token: 35 4572 wmic.exe Token: 36 4572 wmic.exe Token: SeIncreaseQuotaPrivilege 2200 wmic.exe Token: SeSecurityPrivilege 2200 wmic.exe Token: SeTakeOwnershipPrivilege 2200 wmic.exe Token: SeLoadDriverPrivilege 2200 wmic.exe Token: SeSystemProfilePrivilege 2200 wmic.exe Token: SeSystemtimePrivilege 2200 wmic.exe Token: SeProfSingleProcessPrivilege 2200 wmic.exe Token: SeIncBasePriorityPrivilege 2200 wmic.exe Token: SeCreatePagefilePrivilege 2200 wmic.exe Token: SeBackupPrivilege 2200 wmic.exe Token: SeRestorePrivilege 2200 wmic.exe Token: SeShutdownPrivilege 2200 wmic.exe Token: SeDebugPrivilege 2200 wmic.exe Token: SeSystemEnvironmentPrivilege 2200 wmic.exe Token: SeRemoteShutdownPrivilege 2200 wmic.exe Token: SeUndockPrivilege 2200 wmic.exe Token: SeManageVolumePrivilege 2200 wmic.exe Token: 33 2200 wmic.exe Token: 34 2200 wmic.exe Token: 35 2200 wmic.exe Token: 36 2200 wmic.exe Token: SeIncreaseQuotaPrivilege 2200 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2332 wrote to memory of 3740 2332 4ddfd1c0c9106b7ea7e2bc795f11aebd.exe 24 PID 2332 wrote to memory of 3740 2332 4ddfd1c0c9106b7ea7e2bc795f11aebd.exe 24 PID 2332 wrote to memory of 3740 2332 4ddfd1c0c9106b7ea7e2bc795f11aebd.exe 24 PID 3740 wrote to memory of 4572 3740 bedhefifca.exe 21 PID 3740 wrote to memory of 4572 3740 bedhefifca.exe 21 PID 3740 wrote to memory of 4572 3740 bedhefifca.exe 21 PID 3740 wrote to memory of 2200 3740 bedhefifca.exe 32 PID 3740 wrote to memory of 2200 3740 bedhefifca.exe 32 PID 3740 wrote to memory of 2200 3740 bedhefifca.exe 32 PID 3740 wrote to memory of 1796 3740 bedhefifca.exe 31 PID 3740 wrote to memory of 1796 3740 bedhefifca.exe 31 PID 3740 wrote to memory of 1796 3740 bedhefifca.exe 31 PID 3740 wrote to memory of 3356 3740 bedhefifca.exe 30 PID 3740 wrote to memory of 3356 3740 bedhefifca.exe 30 PID 3740 wrote to memory of 3356 3740 bedhefifca.exe 30 PID 3740 wrote to memory of 1360 3740 bedhefifca.exe 29 PID 3740 wrote to memory of 1360 3740 bedhefifca.exe 29 PID 3740 wrote to memory of 1360 3740 bedhefifca.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ddfd1c0c9106b7ea7e2bc795f11aebd.exe"C:\Users\Admin\AppData\Local\Temp\4ddfd1c0c9106b7ea7e2bc795f11aebd.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\bedhefifca.exeC:\Users\Admin\AppData\Local\Temp\bedhefifca.exe 4*6*6*1*3*5*8*9*9*1*9 K0pDQzosMSotMhcrTU9BTUQ8NCcfJko/TlZMTUNAOzwoISwqb29qXGxac2VdZ188T2BhZFhmXBwpPkhQT0E7NDEuMyssHyw+QTs0LxcrSkxOQVA7S1ZIOzksMDgxLhgmSkRJUj9MXlJNRDRfc2tsNCkucG1uJTtESkcnTk5NKDlHRy1ASkBJHyw+REA6SkBANxouQSw1JCgfJkAsNywuGyc7KjwkLRopQzE4JSgXLjsxNycwHSpISUZDTD9OWU9PRE44Olg0HClKUUw/TTpLXjxRRjs8HSpISUZDTD9OWU0+SD00Fy48VD9ZVE9HNRcmRE9BWT1MQUdBRTw8FytCSVJRWjpJRlZKQUw3NB0qTD84TUJVSU9eUk1ENBcuTUk3LB8sP0soNB8mTk9IU0ZIPVZOREM/SUdERkg5PjxUSUg3Gi5GTldJTE1LRUc/PHFtbVwXLklBTk9RS0RGPlZUSkFMWUM+VEs0KR8mREM+RFU4KRcmSEpbPlNNPkhBOlZERT9MU09RQDw0XWBjb18aLkFKT0VDTjhAWUNPOjQtJSg0MCorMjArMCsXJk84TjtGS0JHV0BFUks9RkY8Y1xkalwfJlBDR0Q6LCwqLjMuLSoqMB0qPEZOTUNLOz5eUURFPDQ2Ji4rKTEtLC0hMDkqLDQqMCc8RQ==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704204918.txt bios get version3⤵PID:1360
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704204918.txt bios get version3⤵PID:3356
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704204918.txt bios get version3⤵PID:1796
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704204918.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 9003⤵
- Program crash
PID:3452
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81704204918.txt bios get serialnumber1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3740 -ip 37401⤵PID:2736