1155d79f43e9e6246df3564128a7a5ac105759ae2e134e7a3a74bfa52c0b4629

Analysis

max time kernel
190s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65cecf6a15994ffc1a86feeb41f495ae.exe
Size

611KB
MD5

65cecf6a15994ffc1a86feeb41f495ae
SHA1

0fd13f9aa8d1da016a2f02348ed39e7c80e33c12
SHA256

1155d79f43e9e6246df3564128a7a5ac105759ae2e134e7a3a74bfa52c0b4629
SHA512

4fca8369cc4c19cf5f7a8eae28b8646f070013c0e6d5dc8c0638dab1b449e1b40e3b9b58713dcf01105dd462ececefe8ba79f2d44b46532fd301dd602f1eb278
SSDEEP

12288:hOU3aGSE++yo/REQZAcZq4129Ak5Koe6bDaW2kiZtEf9sSKMX5OLe5E1:hOuanu/+QZAcoJR5UfH2qMX5L5e

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1744	cccabfhdcc.exe

Loads dropped DLL 2 IoCs

pid	Process
4264	65cecf6a15994ffc1a86feeb41f495ae.exe
4264	65cecf6a15994ffc1a86feeb41f495ae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4000	1744	WerFault.exe	92
1868	1744	WerFault.exe	92

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2668	wmic.exe
Token: SeSecurityPrivilege	2668	wmic.exe
Token: SeTakeOwnershipPrivilege	2668	wmic.exe
Token: SeLoadDriverPrivilege	2668	wmic.exe
Token: SeSystemProfilePrivilege	2668	wmic.exe
Token: SeSystemtimePrivilege	2668	wmic.exe
Token: SeProfSingleProcessPrivilege	2668	wmic.exe
Token: SeIncBasePriorityPrivilege	2668	wmic.exe
Token: SeCreatePagefilePrivilege	2668	wmic.exe
Token: SeBackupPrivilege	2668	wmic.exe
Token: SeRestorePrivilege	2668	wmic.exe
Token: SeShutdownPrivilege	2668	wmic.exe
Token: SeDebugPrivilege	2668	wmic.exe
Token: SeSystemEnvironmentPrivilege	2668	wmic.exe
Token: SeRemoteShutdownPrivilege	2668	wmic.exe
Token: SeUndockPrivilege	2668	wmic.exe
Token: SeManageVolumePrivilege	2668	wmic.exe
Token: 33	2668	wmic.exe
Token: 34	2668	wmic.exe
Token: 35	2668	wmic.exe
Token: 36	2668	wmic.exe
Token: SeIncreaseQuotaPrivilege	2668	wmic.exe
Token: SeSecurityPrivilege	2668	wmic.exe
Token: SeTakeOwnershipPrivilege	2668	wmic.exe
Token: SeLoadDriverPrivilege	2668	wmic.exe
Token: SeSystemProfilePrivilege	2668	wmic.exe
Token: SeSystemtimePrivilege	2668	wmic.exe
Token: SeProfSingleProcessPrivilege	2668	wmic.exe
Token: SeIncBasePriorityPrivilege	2668	wmic.exe
Token: SeCreatePagefilePrivilege	2668	wmic.exe
Token: SeBackupPrivilege	2668	wmic.exe
Token: SeRestorePrivilege	2668	wmic.exe
Token: SeShutdownPrivilege	2668	wmic.exe
Token: SeDebugPrivilege	2668	wmic.exe
Token: SeSystemEnvironmentPrivilege	2668	wmic.exe
Token: SeRemoteShutdownPrivilege	2668	wmic.exe
Token: SeUndockPrivilege	2668	wmic.exe
Token: SeManageVolumePrivilege	2668	wmic.exe
Token: 33	2668	wmic.exe
Token: 34	2668	wmic.exe
Token: 35	2668	wmic.exe
Token: 36	2668	wmic.exe
Token: SeIncreaseQuotaPrivilege	3620	wmic.exe
Token: SeSecurityPrivilege	3620	wmic.exe
Token: SeTakeOwnershipPrivilege	3620	wmic.exe
Token: SeLoadDriverPrivilege	3620	wmic.exe
Token: SeSystemProfilePrivilege	3620	wmic.exe
Token: SeSystemtimePrivilege	3620	wmic.exe
Token: SeProfSingleProcessPrivilege	3620	wmic.exe
Token: SeIncBasePriorityPrivilege	3620	wmic.exe
Token: SeCreatePagefilePrivilege	3620	wmic.exe
Token: SeBackupPrivilege	3620	wmic.exe
Token: SeRestorePrivilege	3620	wmic.exe
Token: SeShutdownPrivilege	3620	wmic.exe
Token: SeDebugPrivilege	3620	wmic.exe
Token: SeSystemEnvironmentPrivilege	3620	wmic.exe
Token: SeRemoteShutdownPrivilege	3620	wmic.exe
Token: SeUndockPrivilege	3620	wmic.exe
Token: SeManageVolumePrivilege	3620	wmic.exe
Token: 33	3620	wmic.exe
Token: 34	3620	wmic.exe
Token: 35	3620	wmic.exe
Token: 36	3620	wmic.exe
Token: SeIncreaseQuotaPrivilege	3620	wmic.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1744	4264	65cecf6a15994ffc1a86feeb41f495ae.exe	92
PID 4264 wrote to memory of 1744	4264	65cecf6a15994ffc1a86feeb41f495ae.exe	92
PID 4264 wrote to memory of 1744	4264	65cecf6a15994ffc1a86feeb41f495ae.exe	92
PID 1744 wrote to memory of 2668	1744	cccabfhdcc.exe	93
PID 1744 wrote to memory of 2668	1744	cccabfhdcc.exe	93
PID 1744 wrote to memory of 2668	1744	cccabfhdcc.exe	93
PID 1744 wrote to memory of 3620	1744	cccabfhdcc.exe	95
PID 1744 wrote to memory of 3620	1744	cccabfhdcc.exe	95
PID 1744 wrote to memory of 3620	1744	cccabfhdcc.exe	95
PID 1744 wrote to memory of 3236	1744	cccabfhdcc.exe	97
PID 1744 wrote to memory of 3236	1744	cccabfhdcc.exe	97
PID 1744 wrote to memory of 3236	1744	cccabfhdcc.exe	97
PID 1744 wrote to memory of 1996	1744	cccabfhdcc.exe	99
PID 1744 wrote to memory of 1996	1744	cccabfhdcc.exe	99
PID 1744 wrote to memory of 1996	1744	cccabfhdcc.exe	99
PID 1744 wrote to memory of 2840	1744	cccabfhdcc.exe	101
PID 1744 wrote to memory of 2840	1744	cccabfhdcc.exe	101
PID 1744 wrote to memory of 2840	1744	cccabfhdcc.exe	101
PID 1744 wrote to memory of 4000	1744	cccabfhdcc.exe	106
PID 1744 wrote to memory of 4000	1744	cccabfhdcc.exe	106
PID 1744 wrote to memory of 4000	1744	cccabfhdcc.exe	106

C:\Users\Admin\AppData\Local\Temp\65cecf6a15994ffc1a86feeb41f495ae.exe
"C:\Users\Admin\AppData\Local\Temp\65cecf6a15994ffc1a86feeb41f495ae.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\cccabfhdcc.exe
  C:\Users\Admin\AppData\Local\Temp\cccabfhdcc.exe 5-8-7-0-1-4-0-2-5-3-1 KkhCRDwtODcvLR8qS05CT0VEOysdLkk9TVdOTktHPzowGyc9SVJQSUI4LzQrMSsgLj9JQjgtHypIS09DUUNSWkZDOCotMjY0IC1OQlFRPUtfVE5MO2Nxc2syKC9yYXJ0KXFnYCVacG8pZF9vXi1kZl9vHytDSkRASkQ8NiAuQDE7Kx0uPyo2LTAcL0IuOiwsGChEMzktLxssQzA1JjEfK1BQSkFUPkxYUFFFVj8+VjwbJ0lSTkBVQU9cRFBEOj0fK1BQSkFUPkxYTkBJRTtFXnVcHSswUXFucmRqZCAqKUVtcmlwamtsYGZtIC5BWENaUlFHNWF0c2w6LSpeb2trbHRgcGlhLWNjL2teNWRpLnEuK2BoWXNvbV13cSlgbmgnY3JkKTdzMS0scmFnZG5zcytkMjcxJl54ZBwvQ1NCXj5FPUxISkU7GyxHSktNX0FOT1VOQlE4KhkvU0RBTEZWTlBXTlJLOSAtUUo8LRgoRFItPS8vLzE0KSszNS00NywwK1BLJWFlYmwwNC8rLisuLG5ebioxNSs+YGtvbGEsNCwxZDMtMGMyL2ZjNDViXCouNzI0NmEyYWMxKV1jYzIscXBfaF81KjAxMjIuWmNgXSkpZDczODYvMGAyK1owNS1hLjAwZDAwLjNkNDJkGyxRUEZNSUxBX1VASUJKRT5JTD1HQ1BPSzgYKElSW1JTSVFISD02dHFxZR4qT0RPTUtOSEpHXVBQRE1XPUFYTz0wGyxHRDw+WDwtIC1EUF4/UUdBTEVDXUBLQk1RSVREQD1kXGlyYBgoRE5TTkpKPkNaQUk9NjEuLy4wLSwsLi4wLzUeKlFISD02MTMuMjcsLzI0KhkvQ0tXTEdMQD9XTUlMQT0wKi8uLSgqNSk1OjAxNzItIklN
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703697363.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703697363.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3620
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703697363.txt bios get version
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703697363.txt bios get version
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81703697363.txt bios get version
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 844
    3⤵
    - Program crash
    PID:4000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 844
    3⤵
    - Program crash
    PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1744 -ip 1744
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81703697363.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703697363.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\81703697363.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\cccabfhdcc.exe

Filesize
320KB

MD5
c6b68ffbd7012244e9fde371e82c08e5

SHA1
00cb1ed0bd73f36a04019669837f240e837046a6

SHA256
44c3a7e4be45a33d51a7d14427c9c3c2dae7e940bfc2a3ee0afec70738ac69a3

SHA512
64b523001f0fa7a98305aa204f30a62ef326553c7f228edc1f29d50a5d94e63ac093e0b18ed724017e60e16df9593df13b96bad1dcacac2479bee10ce1cc3aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\cccabfhdcc.exe

Filesize
270KB

MD5
69e5f8cfc51bfa304a899fb00fbe4370

SHA1
66cbd9fa53d37ea72dfce9d715412bc2b274b469

SHA256
e408fa89cbcd02e0347690fa6d436e94117655ec05b9b8f879b72bbccfe5470c

SHA512
4d1e1daf9c409c699b048793859cd621c5fbe3ccce1c9b814b6e25abcec7b5a14b3c838b5879540faa712bcb494f39124d19835f2a1873f35bfa6e49993ddf90

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd999C.tmp\7tm.dll

Filesize
121KB

MD5
b7c88041bb05a8b5e5fe4336b4554fad

SHA1
9000e6b54e86245ae1fbc259563e0f514ed5b434

SHA256
d8039d7364def8247da83b5b3d824a72096ddaa0a585881902e238093056ea83

SHA512
2aadf59392888801100bac11b5e4c0c67244624a38eba0007112bb9fe61d0ec61183154ee4e99e2af5389704462665a55fa1b2a539d6cd2fb1c5b7fd438f4b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd999C.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit