Analysis
-
max time kernel
240s -
max time network
273s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 13:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
71c6f1d270893cd45484eec1577c0a9f.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
71c6f1d270893cd45484eec1577c0a9f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
71c6f1d270893cd45484eec1577c0a9f.exe
-
Size
677KB
-
MD5
71c6f1d270893cd45484eec1577c0a9f
-
SHA1
6d99ef29a57281c48c27f28d8903c6e935d39c17
-
SHA256
140644cd75a50ef471110867aee91be8245e691d3eb3bb01b7626762e89b558a
-
SHA512
8a30fa922e709c7f080c87e50d29d6da1d6a14bcf38ea8cf3470dd532d5eaa3fa062250416d3b9dd5f2411153c236114ea28c89089f5539952ee438447285ff7
-
SSDEEP
12288:wsFkxxnYNxh6a5HYLeViPaQ+o8/GYpXdO2zcSHnPMepV8xAwKQs5ZYnGKrOL:wsFaFYNOSYuiPadoYGYJ82RHPMDo5ZY4
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1140 1432026082.exe -
Loads dropped DLL 11 IoCs
pid Process 2044 71c6f1d270893cd45484eec1577c0a9f.exe 2044 71c6f1d270893cd45484eec1577c0a9f.exe 2044 71c6f1d270893cd45484eec1577c0a9f.exe 2044 71c6f1d270893cd45484eec1577c0a9f.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2272 1140 WerFault.exe 27 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 480 wmic.exe Token: SeSecurityPrivilege 480 wmic.exe Token: SeTakeOwnershipPrivilege 480 wmic.exe Token: SeLoadDriverPrivilege 480 wmic.exe Token: SeSystemProfilePrivilege 480 wmic.exe Token: SeSystemtimePrivilege 480 wmic.exe Token: SeProfSingleProcessPrivilege 480 wmic.exe Token: SeIncBasePriorityPrivilege 480 wmic.exe Token: SeCreatePagefilePrivilege 480 wmic.exe Token: SeBackupPrivilege 480 wmic.exe Token: SeRestorePrivilege 480 wmic.exe Token: SeShutdownPrivilege 480 wmic.exe Token: SeDebugPrivilege 480 wmic.exe Token: SeSystemEnvironmentPrivilege 480 wmic.exe Token: SeRemoteShutdownPrivilege 480 wmic.exe Token: SeUndockPrivilege 480 wmic.exe Token: SeManageVolumePrivilege 480 wmic.exe Token: 33 480 wmic.exe Token: 34 480 wmic.exe Token: 35 480 wmic.exe Token: SeIncreaseQuotaPrivilege 480 wmic.exe Token: SeSecurityPrivilege 480 wmic.exe Token: SeTakeOwnershipPrivilege 480 wmic.exe Token: SeLoadDriverPrivilege 480 wmic.exe Token: SeSystemProfilePrivilege 480 wmic.exe Token: SeSystemtimePrivilege 480 wmic.exe Token: SeProfSingleProcessPrivilege 480 wmic.exe Token: SeIncBasePriorityPrivilege 480 wmic.exe Token: SeCreatePagefilePrivilege 480 wmic.exe Token: SeBackupPrivilege 480 wmic.exe Token: SeRestorePrivilege 480 wmic.exe Token: SeShutdownPrivilege 480 wmic.exe Token: SeDebugPrivilege 480 wmic.exe Token: SeSystemEnvironmentPrivilege 480 wmic.exe Token: SeRemoteShutdownPrivilege 480 wmic.exe Token: SeUndockPrivilege 480 wmic.exe Token: SeManageVolumePrivilege 480 wmic.exe Token: 33 480 wmic.exe Token: 34 480 wmic.exe Token: 35 480 wmic.exe Token: SeIncreaseQuotaPrivilege 1252 wmic.exe Token: SeSecurityPrivilege 1252 wmic.exe Token: SeTakeOwnershipPrivilege 1252 wmic.exe Token: SeLoadDriverPrivilege 1252 wmic.exe Token: SeSystemProfilePrivilege 1252 wmic.exe Token: SeSystemtimePrivilege 1252 wmic.exe Token: SeProfSingleProcessPrivilege 1252 wmic.exe Token: SeIncBasePriorityPrivilege 1252 wmic.exe Token: SeCreatePagefilePrivilege 1252 wmic.exe Token: SeBackupPrivilege 1252 wmic.exe Token: SeRestorePrivilege 1252 wmic.exe Token: SeShutdownPrivilege 1252 wmic.exe Token: SeDebugPrivilege 1252 wmic.exe Token: SeSystemEnvironmentPrivilege 1252 wmic.exe Token: SeRemoteShutdownPrivilege 1252 wmic.exe Token: SeUndockPrivilege 1252 wmic.exe Token: SeManageVolumePrivilege 1252 wmic.exe Token: 33 1252 wmic.exe Token: 34 1252 wmic.exe Token: 35 1252 wmic.exe Token: SeIncreaseQuotaPrivilege 2356 wmic.exe Token: SeSecurityPrivilege 2356 wmic.exe Token: SeTakeOwnershipPrivilege 2356 wmic.exe Token: SeLoadDriverPrivilege 2356 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1140 2044 71c6f1d270893cd45484eec1577c0a9f.exe 27 PID 2044 wrote to memory of 1140 2044 71c6f1d270893cd45484eec1577c0a9f.exe 27 PID 2044 wrote to memory of 1140 2044 71c6f1d270893cd45484eec1577c0a9f.exe 27 PID 2044 wrote to memory of 1140 2044 71c6f1d270893cd45484eec1577c0a9f.exe 27 PID 1140 wrote to memory of 480 1140 1432026082.exe 28 PID 1140 wrote to memory of 480 1140 1432026082.exe 28 PID 1140 wrote to memory of 480 1140 1432026082.exe 28 PID 1140 wrote to memory of 480 1140 1432026082.exe 28 PID 1140 wrote to memory of 1252 1140 1432026082.exe 31 PID 1140 wrote to memory of 1252 1140 1432026082.exe 31 PID 1140 wrote to memory of 1252 1140 1432026082.exe 31 PID 1140 wrote to memory of 1252 1140 1432026082.exe 31 PID 1140 wrote to memory of 2356 1140 1432026082.exe 33 PID 1140 wrote to memory of 2356 1140 1432026082.exe 33 PID 1140 wrote to memory of 2356 1140 1432026082.exe 33 PID 1140 wrote to memory of 2356 1140 1432026082.exe 33 PID 1140 wrote to memory of 1144 1140 1432026082.exe 35 PID 1140 wrote to memory of 1144 1140 1432026082.exe 35 PID 1140 wrote to memory of 1144 1140 1432026082.exe 35 PID 1140 wrote to memory of 1144 1140 1432026082.exe 35 PID 1140 wrote to memory of 1772 1140 1432026082.exe 37 PID 1140 wrote to memory of 1772 1140 1432026082.exe 37 PID 1140 wrote to memory of 1772 1140 1432026082.exe 37 PID 1140 wrote to memory of 1772 1140 1432026082.exe 37 PID 1140 wrote to memory of 2272 1140 1432026082.exe 39 PID 1140 wrote to memory of 2272 1140 1432026082.exe 39 PID 1140 wrote to memory of 2272 1140 1432026082.exe 39 PID 1140 wrote to memory of 2272 1140 1432026082.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\71c6f1d270893cd45484eec1577c0a9f.exe"C:\Users\Admin\AppData\Local\Temp\71c6f1d270893cd45484eec1577c0a9f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\1432026082.exeC:\Users\Admin\AppData\Local\Temp\1432026082.exe 7\5\9\1\9\5\3\5\4\9\4 KEtAQzQuLS0uFytMUDlPQD86KxwmSj5PTk5JRkY/OSccKD9AUktEQTguLi4wLxcuOkRBOCwXK0lNRkNMPlFaRTs5KjEwMxcqUEBOTUFLWkxRQzhlb3BnNigqanFtKUFAT0IpTUpHLDhLTSlFRUJIGyZCQ0RARkU7OXA+PEYpNC88UkNSMTNIR0FCMEVKJy8xShcuOyw6LCwnNBkqOzE0KC4bKzsvNigoHyY/MTgpKBwoPyw8JCwdKkxJSz1QOlNWS09EUjg/UjgXLkdNTD9ROlBYQExLODgdKkxJSz1QOlNWST5IQTQcKEBPRFZQT0c5Fys+UzxeOkhBR0VFQTYbJkdGTlFaPklLUE48UTQuHSpQPz1HRlBOTFpSTUg0HChRRDwpGyw/Tyg5GSpJVEVPRkhBVlM+RzpOREBGSD0+QU5NQzwXKkZOW0lRR09ATDw4cW1xXBwoTTxTTE1LREo+W05OPFFWPz5UTzQuGSo/SDtAVTgtFytCTlZDUEk+SEU6Wz5JOlFQS1FAQDRiWmdqZBcqQUpTRUhIPDteQEs6LC4vKi8zJTAwKS4vNRcrTURERDQsMS4uJy8wMSoyFypBSlNFSEg8O15LREpAOSwrKjQmMScsMiUtKTYqLjE0KiVNSBwmUTo4Rm9cbV4gLl01JzMnKh9SZmlgZnNsJkVTIjArLCEqXiRISUAiMSstJx9ebmRjYyIyMCwwICUkS2lkam9sIC5dLicsKS0qMzUmUlxubGRmbRwtYywuJS0vGyZUSUc6Y3BrbB4uWCQpYSItYl5hbSwlLygsLl9hamVgaSVoZWFsIC5dTm5pS2hkYEFqc2VoaFxbTFhpXmJhaVtdYGdrZnQiLWIoMCwtJzIuMTAwISliXWpubWNqXl9pWGpaYlxxHC1jLDAqLikuLjUqMCIuYig1MTEvLysyLzI0UWhxbkJ5OCAvYV47VXFGSm5vQ1NyL0JmXHBEQ0BhVz9zZkhjSGpJZGovR2QwX0Y/SG9CZGQvRWMscElgVG5DU3JwRU8pbz8xQG9LTnNmRGUva09KZm5FQjBkWixvbE4tU2dLTnRjXU4wbUNTb2lQU0dpUGxALV8rRS9McnJvTGEsTU5nL3NHK19AST81dU5iX25HO0FGQ1RBYFEuLTBCdg==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703721317.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:480
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703721317.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703721317.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703721317.txt bios get version3⤵PID:1144
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703721317.txt bios get version3⤵PID:1772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:2272
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
158KB
MD5704dfc3222f6734fe248d96c42aac826
SHA10348ab95aa6268554f35b9e1c9be3192c6ffa7b8
SHA256416f599582e7d5e1a92938221cb8d7abb93593fea0907ab5884d549a3d5e6818
SHA512e48c9ba9c819ce6c60e48379fb70dec4751c15b30ed3baccd7b376757b47b00c414a4e84cbc1fde83d8d8c7b57f0b1bfe7dc5463a256dd6a99deaae3bef380d0
-
Filesize
1021KB
MD506d92043f7440dc67af4c9ca4ea1b4c8
SHA18efafd47053445403d0231befefd6d2194a0b4fc
SHA25600382b5d8424966c67920c7061a4371b78839b7ff7b8a57ba70ab216cef585bb
SHA512986d7c45e86a050506861f90165dcb4f3027ed841f7ffbf8a4c5dc7581afbcea1f21646a4148f1734e21e3e2bd919bc188c8b256f728e2e16e03f454624bf545
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5