047b1f3cdb2b571c1e3c917741bd19be3383088d0d9ee950e986059b67282433

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb033f36dc08cad0f7cfebe1160a8f98.exe
Size

613KB
MD5

fb033f36dc08cad0f7cfebe1160a8f98
SHA1

de3fb9e2b5417321dc2814f0d6b77403f6d78ea5
SHA256

047b1f3cdb2b571c1e3c917741bd19be3383088d0d9ee950e986059b67282433
SHA512

18f5c1940eaf13e3ee078b7992c6d58a72aaa2d8a8500c0bcec04c975376ef7537bd89c44ad6e92472580fbf6a24f070822f229018ed76d2f447301a5a5652ab
SSDEEP

12288:vUPMLTKsQPvYVK3tr/nnnMzCBz1jTU2iEaWn8VOVP8:vQPvn3tzn7dbF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4996	1430946085.exe

Loads dropped DLL 2 IoCs

pid	Process
2008	fb033f36dc08cad0f7cfebe1160a8f98.exe
2008	fb033f36dc08cad0f7cfebe1160a8f98.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3760	4996	WerFault.exe	89

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3668	wmic.exe
Token: SeSecurityPrivilege	3668	wmic.exe
Token: SeTakeOwnershipPrivilege	3668	wmic.exe
Token: SeLoadDriverPrivilege	3668	wmic.exe
Token: SeSystemProfilePrivilege	3668	wmic.exe
Token: SeSystemtimePrivilege	3668	wmic.exe
Token: SeProfSingleProcessPrivilege	3668	wmic.exe
Token: SeIncBasePriorityPrivilege	3668	wmic.exe
Token: SeCreatePagefilePrivilege	3668	wmic.exe
Token: SeBackupPrivilege	3668	wmic.exe
Token: SeRestorePrivilege	3668	wmic.exe
Token: SeShutdownPrivilege	3668	wmic.exe
Token: SeDebugPrivilege	3668	wmic.exe
Token: SeSystemEnvironmentPrivilege	3668	wmic.exe
Token: SeRemoteShutdownPrivilege	3668	wmic.exe
Token: SeUndockPrivilege	3668	wmic.exe
Token: SeManageVolumePrivilege	3668	wmic.exe
Token: 33	3668	wmic.exe
Token: 34	3668	wmic.exe
Token: 35	3668	wmic.exe
Token: 36	3668	wmic.exe
Token: SeIncreaseQuotaPrivilege	3668	wmic.exe
Token: SeSecurityPrivilege	3668	wmic.exe
Token: SeTakeOwnershipPrivilege	3668	wmic.exe
Token: SeLoadDriverPrivilege	3668	wmic.exe
Token: SeSystemProfilePrivilege	3668	wmic.exe
Token: SeSystemtimePrivilege	3668	wmic.exe
Token: SeProfSingleProcessPrivilege	3668	wmic.exe
Token: SeIncBasePriorityPrivilege	3668	wmic.exe
Token: SeCreatePagefilePrivilege	3668	wmic.exe
Token: SeBackupPrivilege	3668	wmic.exe
Token: SeRestorePrivilege	3668	wmic.exe
Token: SeShutdownPrivilege	3668	wmic.exe
Token: SeDebugPrivilege	3668	wmic.exe
Token: SeSystemEnvironmentPrivilege	3668	wmic.exe
Token: SeRemoteShutdownPrivilege	3668	wmic.exe
Token: SeUndockPrivilege	3668	wmic.exe
Token: SeManageVolumePrivilege	3668	wmic.exe
Token: 33	3668	wmic.exe
Token: 34	3668	wmic.exe
Token: 35	3668	wmic.exe
Token: 36	3668	wmic.exe
Token: SeIncreaseQuotaPrivilege	1908	wmic.exe
Token: SeSecurityPrivilege	1908	wmic.exe
Token: SeTakeOwnershipPrivilege	1908	wmic.exe
Token: SeLoadDriverPrivilege	1908	wmic.exe
Token: SeSystemProfilePrivilege	1908	wmic.exe
Token: SeSystemtimePrivilege	1908	wmic.exe
Token: SeProfSingleProcessPrivilege	1908	wmic.exe
Token: SeIncBasePriorityPrivilege	1908	wmic.exe
Token: SeCreatePagefilePrivilege	1908	wmic.exe
Token: SeBackupPrivilege	1908	wmic.exe
Token: SeRestorePrivilege	1908	wmic.exe
Token: SeShutdownPrivilege	1908	wmic.exe
Token: SeDebugPrivilege	1908	wmic.exe
Token: SeSystemEnvironmentPrivilege	1908	wmic.exe
Token: SeRemoteShutdownPrivilege	1908	wmic.exe
Token: SeUndockPrivilege	1908	wmic.exe
Token: SeManageVolumePrivilege	1908	wmic.exe
Token: 33	1908	wmic.exe
Token: 34	1908	wmic.exe
Token: 35	1908	wmic.exe
Token: 36	1908	wmic.exe
Token: SeIncreaseQuotaPrivilege	1908	wmic.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 4996	2008	fb033f36dc08cad0f7cfebe1160a8f98.exe	89
PID 2008 wrote to memory of 4996	2008	fb033f36dc08cad0f7cfebe1160a8f98.exe	89
PID 2008 wrote to memory of 4996	2008	fb033f36dc08cad0f7cfebe1160a8f98.exe	89
PID 4996 wrote to memory of 3668	4996	1430946085.exe	91
PID 4996 wrote to memory of 3668	4996	1430946085.exe	91
PID 4996 wrote to memory of 3668	4996	1430946085.exe	91
PID 4996 wrote to memory of 1908	4996	1430946085.exe	95
PID 4996 wrote to memory of 1908	4996	1430946085.exe	95
PID 4996 wrote to memory of 1908	4996	1430946085.exe	95
PID 4996 wrote to memory of 1396	4996	1430946085.exe	98
PID 4996 wrote to memory of 1396	4996	1430946085.exe	98
PID 4996 wrote to memory of 1396	4996	1430946085.exe	98
PID 4996 wrote to memory of 2340	4996	1430946085.exe	100
PID 4996 wrote to memory of 2340	4996	1430946085.exe	100
PID 4996 wrote to memory of 2340	4996	1430946085.exe	100
PID 4996 wrote to memory of 764	4996	1430946085.exe	102
PID 4996 wrote to memory of 764	4996	1430946085.exe	102
PID 4996 wrote to memory of 764	4996	1430946085.exe	102

C:\Users\Admin\AppData\Local\Temp\fb033f36dc08cad0f7cfebe1160a8f98.exe
"C:\Users\Admin\AppData\Local\Temp\fb033f36dc08cad0f7cfebe1160a8f98.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\1430946085.exe
  C:\Users\Admin\AppData\Local\Temp\1430946085.exe 5#2#6#1#2#5#6#5#2#1#4 Kk5DQzsuKi0wHytOUzxPRz83Kx4uSkBSUU5QRkM/Oy8cKkJDUlJEPjgwNi4yMBouQUQ+OC4fK0tQSUNTPk5aR0M5LDQzMx4qTUBQVUFNXU9RSjhib3JvNiotbXF0KT5AUUopT01KLD9LSilHTUJKHilCSkQ9RkdDOXJCRTM2UC0/SUpOQzQqMUkrQkg2NSwxLhouQiw3LC8vLDAeKUMwOCcsHi5ALjsnMB4qPi87LC0bLT40OygrGy1PTkpCT0JSWkpNR1U9Plc3Hy1LTEpCVD9PXT9USjw3Gy1PTkpCT0JSWkg8S0Q5Gy0/V0NaT01KPBwqQ1JEXT5HP0pISkA7Gi5GSk1PXUFOSlVNRFA4LBstU0Q8TEVYTVBZUFBLORstUEw7LRoqQlItOB4pUVNJTkRLRFtSQ0ZCTUg/REtAQ0BTTEs7GylEUV5OUExOSEtAN29wdGEbLUxEUlBMSUdNQ1pTTURQWj48V1I5LR4pR0c/P1M7MBwqR01eQlRIPEtIP1pDSEJQVEpPQ0M5YV9mcmMbKT9NVkpHTTtDXURKODYxKiw1LS0yLSgtNR8rT0dHRDssLi4uODEyMDEyHio+SlVNSEo/Pl5SREdAOzQrMi0sLy8wJCwwOSwyOC8yKDxHGy1UPThLaXlnZ2ZcIzFiMCwqKiZSY2libnNuKUhTKTEoLCcqPWtuZmRVYFxGZ3MhLWQvMjUpLTEpJ0dDUkdLIy1dJmpoZ2ApQWRhZmkkKUJkbW1nZCMtYC8wLSwpMC0wLykrLjMqT1xkW3FnICxhMzIzKTEwHy1QTEc7Z3Bvbh8yXyAsYSMxYmJjbi0uLCwuYC1laWRpJDBhTHBsU2VoYz5udWlmal9jSVxsW2ZjbVlfY29oancfMWQsLi4uODEyMDIvIy1gLDIyLDQzMTE2Kx8tZDAwLi4zNDUtMisjMmIwLzIzMCwvMy80NFRrTHJKZDIgMGFddVNzSndqbkVUdjFIQlNzSnU/Y1hDY3JKZFR3RVFmL0t1QWFGQ3VrRk4ydUk9M2RLUlBpSEA0Y0hScW5JTlBhSkNjbklNSWdJPmJqTD9BY1RGcl9bZzdyVT9Uc1hFc3FddjRiXGtiZFctYmFMV0Y/T3RAMFE9LzZSZ1VJS3lTakZmaXVNK1MtTFFickd2NGhUVS9vTE8/Y2FsTnFMTTM=
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704291752.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3668
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704291752.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704291752.txt bios get version
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704291752.txt bios get version
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704291752.txt bios get version
    3⤵
    PID:764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 852
    3⤵
    - Program crash
    PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4996 -ip 4996
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1430946085.exe

Filesize
263KB

MD5
b26c7c559f6afafd36ddf8b7b66161c4

SHA1
0f1265e0d7cd62077c557be724d0911e3ea76d4f

SHA256
40faf06a617ba97448cbcbc602b7af9db36460ab3a1ecbe650567f9d355b2572

SHA512
13e7993837493f0c1e905fff928b5d47b8a2a821b046df894826030995cdd8e64e179843b063a7c6d17ec958931bbfbef361a71a01e242b14a02bad49eb66f47

Download Submit
C:\Users\Admin\AppData\Local\Temp\81704291752.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81704291752.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81704291752.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz4612.tmp\frjhhh.dll

Filesize
121KB

MD5
8e829dbcecc3f95bc28378783fc644a5

SHA1
70d5ace6debcc9258ac9b34e4c1b59a09351aa14

SHA256
23a551a312cb3c6ddd25a30fb1c04887d3b7fccf2e567fdac2ffa7cc1c541a3e

SHA512
4bae3ad907b33676da626113b9a1833873d052c10a16399f4298273c96160a01fd1da7b19e99414ed87456e9f010510ea6f798e09a01ffd39e952efdf771db60

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz4612.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit