10b9879f3c5ff7f70d8fc4249da79de329cc69e0b7ccc0e97c4761e9723d9821

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f789357931b6a490dfa352a3747a4c1d.exe
Size

665KB
MD5

f789357931b6a490dfa352a3747a4c1d
SHA1

e4ebe8b08a03906c38aa093869f913ca7c2a3e38
SHA256

10b9879f3c5ff7f70d8fc4249da79de329cc69e0b7ccc0e97c4761e9723d9821
SHA512

f37e60a9bc593d3481ac0a722467fca143977a54dc586f02e177148081dfbedf67100e6b8ac2a0bab7ab0221342ddef366460f09b8cc16f035d4508c3a705747
SSDEEP

12288:4ZVJObUVJfcUnznsGauOyjILjVIEJzvUobm/LBVh5Gfc8vy4hX:4ZVJiKhXQLyjaBIEJzvhmzBjt86c

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2708	bedfgaajca.exe

Loads dropped DLL 11 IoCs

pid	Process
2132	f789357931b6a490dfa352a3747a4c1d.exe
2132	f789357931b6a490dfa352a3747a4c1d.exe
2132	f789357931b6a490dfa352a3747a4c1d.exe
2132	f789357931b6a490dfa352a3747a4c1d.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2304	2708	WerFault.exe	30

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2848	wmic.exe
Token: SeSecurityPrivilege	2848	wmic.exe
Token: SeTakeOwnershipPrivilege	2848	wmic.exe
Token: SeLoadDriverPrivilege	2848	wmic.exe
Token: SeSystemProfilePrivilege	2848	wmic.exe
Token: SeSystemtimePrivilege	2848	wmic.exe
Token: SeProfSingleProcessPrivilege	2848	wmic.exe
Token: SeIncBasePriorityPrivilege	2848	wmic.exe
Token: SeCreatePagefilePrivilege	2848	wmic.exe
Token: SeBackupPrivilege	2848	wmic.exe
Token: SeRestorePrivilege	2848	wmic.exe
Token: SeShutdownPrivilege	2848	wmic.exe
Token: SeDebugPrivilege	2848	wmic.exe
Token: SeSystemEnvironmentPrivilege	2848	wmic.exe
Token: SeRemoteShutdownPrivilege	2848	wmic.exe
Token: SeUndockPrivilege	2848	wmic.exe
Token: SeManageVolumePrivilege	2848	wmic.exe
Token: 33	2848	wmic.exe
Token: 34	2848	wmic.exe
Token: 35	2848	wmic.exe
Token: SeIncreaseQuotaPrivilege	2848	wmic.exe
Token: SeSecurityPrivilege	2848	wmic.exe
Token: SeTakeOwnershipPrivilege	2848	wmic.exe
Token: SeLoadDriverPrivilege	2848	wmic.exe
Token: SeSystemProfilePrivilege	2848	wmic.exe
Token: SeSystemtimePrivilege	2848	wmic.exe
Token: SeProfSingleProcessPrivilege	2848	wmic.exe
Token: SeIncBasePriorityPrivilege	2848	wmic.exe
Token: SeCreatePagefilePrivilege	2848	wmic.exe
Token: SeBackupPrivilege	2848	wmic.exe
Token: SeRestorePrivilege	2848	wmic.exe
Token: SeShutdownPrivilege	2848	wmic.exe
Token: SeDebugPrivilege	2848	wmic.exe
Token: SeSystemEnvironmentPrivilege	2848	wmic.exe
Token: SeRemoteShutdownPrivilege	2848	wmic.exe
Token: SeUndockPrivilege	2848	wmic.exe
Token: SeManageVolumePrivilege	2848	wmic.exe
Token: 33	2848	wmic.exe
Token: 34	2848	wmic.exe
Token: 35	2848	wmic.exe
Token: SeIncreaseQuotaPrivilege	2872	wmic.exe
Token: SeSecurityPrivilege	2872	wmic.exe
Token: SeTakeOwnershipPrivilege	2872	wmic.exe
Token: SeLoadDriverPrivilege	2872	wmic.exe
Token: SeSystemProfilePrivilege	2872	wmic.exe
Token: SeSystemtimePrivilege	2872	wmic.exe
Token: SeProfSingleProcessPrivilege	2872	wmic.exe
Token: SeIncBasePriorityPrivilege	2872	wmic.exe
Token: SeCreatePagefilePrivilege	2872	wmic.exe
Token: SeBackupPrivilege	2872	wmic.exe
Token: SeRestorePrivilege	2872	wmic.exe
Token: SeShutdownPrivilege	2872	wmic.exe
Token: SeDebugPrivilege	2872	wmic.exe
Token: SeSystemEnvironmentPrivilege	2872	wmic.exe
Token: SeRemoteShutdownPrivilege	2872	wmic.exe
Token: SeUndockPrivilege	2872	wmic.exe
Token: SeManageVolumePrivilege	2872	wmic.exe
Token: 33	2872	wmic.exe
Token: 34	2872	wmic.exe
Token: 35	2872	wmic.exe
Token: SeIncreaseQuotaPrivilege	2568	wmic.exe
Token: SeSecurityPrivilege	2568	wmic.exe
Token: SeTakeOwnershipPrivilege	2568	wmic.exe
Token: SeLoadDriverPrivilege	2568	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2708	2132	f789357931b6a490dfa352a3747a4c1d.exe	30
PID 2132 wrote to memory of 2708	2132	f789357931b6a490dfa352a3747a4c1d.exe	30
PID 2132 wrote to memory of 2708	2132	f789357931b6a490dfa352a3747a4c1d.exe	30
PID 2132 wrote to memory of 2708	2132	f789357931b6a490dfa352a3747a4c1d.exe	30
PID 2708 wrote to memory of 2848	2708	bedfgaajca.exe	29
PID 2708 wrote to memory of 2848	2708	bedfgaajca.exe	29
PID 2708 wrote to memory of 2848	2708	bedfgaajca.exe	29
PID 2708 wrote to memory of 2848	2708	bedfgaajca.exe	29
PID 2708 wrote to memory of 2872	2708	bedfgaajca.exe	35
PID 2708 wrote to memory of 2872	2708	bedfgaajca.exe	35
PID 2708 wrote to memory of 2872	2708	bedfgaajca.exe	35
PID 2708 wrote to memory of 2872	2708	bedfgaajca.exe	35
PID 2708 wrote to memory of 2568	2708	bedfgaajca.exe	34
PID 2708 wrote to memory of 2568	2708	bedfgaajca.exe	34
PID 2708 wrote to memory of 2568	2708	bedfgaajca.exe	34
PID 2708 wrote to memory of 2568	2708	bedfgaajca.exe	34
PID 2708 wrote to memory of 2728	2708	bedfgaajca.exe	37
PID 2708 wrote to memory of 2728	2708	bedfgaajca.exe	37
PID 2708 wrote to memory of 2728	2708	bedfgaajca.exe	37
PID 2708 wrote to memory of 2728	2708	bedfgaajca.exe	37
PID 2708 wrote to memory of 2824	2708	bedfgaajca.exe	39
PID 2708 wrote to memory of 2824	2708	bedfgaajca.exe	39
PID 2708 wrote to memory of 2824	2708	bedfgaajca.exe	39
PID 2708 wrote to memory of 2824	2708	bedfgaajca.exe	39
PID 2708 wrote to memory of 2304	2708	bedfgaajca.exe	40
PID 2708 wrote to memory of 2304	2708	bedfgaajca.exe	40
PID 2708 wrote to memory of 2304	2708	bedfgaajca.exe	40
PID 2708 wrote to memory of 2304	2708	bedfgaajca.exe	40

C:\Users\Admin\AppData\Local\Temp\f789357931b6a490dfa352a3747a4c1d.exe
"C:\Users\Admin\AppData\Local\Temp\f789357931b6a490dfa352a3747a4c1d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\bedfgaajca.exe
  C:\Users\Admin\AppData\Local\Temp\bedfgaajca.exe 6|8|8|5|7|4|4|8|1|9|0 KUhBPzYtNSs1KiApS009SUVANS8XL0g9TFJITkdBQzQxHyooa2trYG1ia25bZV04S2FlZWBeZRonPERMUEU8PCk3MSkqGyg/RTw8JyApSEpKPVE/TF5ARDcqLjQtLxwnUjxSUD1KWk5OSDVna3RqMicqbG5yJkM8U0UlTEpJKT1ITyVJSD5HGyg/SEFCQkk+NRgqPS05JTAXLz4qNSgqHCs8MjQtKxgnPy05KSkfJkQvNSUsGStMSk47VT1MV0tLRVI5QlA9GidITUhAUTtTVkVPRDk4GStMSk47VT1MV0k6SUE1HyZFUj1XUEtIORguPFg/VztIPUhFRkQ0IClAR05NWz5KTk5TP0o1MBkrUEBARUtTR01aTk5INR8mVkc1KhsoQE8pPBcvTE1GT0JJQVdWPEw9R0VAQkk9P0RMUkY1GCpCT1tKVEVUQ0U9OG1ucV0fJlI/TE1NR0VKP15MUz9KVz86VU81MRcvQkE8QFE5LRguQFNZPFFJOklFO148Tj1KUUtNQUA1ZVhsbV0YKj1LU0ZLRkE+V0FLNi0zLi0rMygqLC4nLi4tHyZUQ0U9OCowLy01KDIuKi4bKEBLT01DTzs8V09CSUE1NSYyMycqKyoxJjE5KDM0LC4lSUk=
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704283538.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704283538.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704283538.txt bios get version
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704283538.txt bios get version
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 372
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2304

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81704283538.txt bios get serialnumber
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81704283538.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\bedfgaajca.exe

Filesize
93KB

MD5
49a130d2a66ffca012800efb3df7eed5

SHA1
bdb0f2b3e72d25c82d39b99e9bb85221001cee8c

SHA256
7d515221b38881073cc4f265b70ae08454179b5bab9ca85be21193ee46e8b309

SHA512
ca5681127522d4fcc95ed529c0c740fddbc9463d06c8017f6355250485f1b51358b37c2da809686203ae3c7b3951be5986974adb3897352dce3f3e33bc247ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\bedfgaajca.exe

Filesize
381KB

MD5
f45f9ce1f31801b8a178d143fe43ab75

SHA1
98e945674686e139d3eb70e7c11321c39526995a

SHA256
dc887234343a5df9120c8a53a54aca0c2b73feae02a14054c9a6d225f481ba70

SHA512
657d1a1edb33db5a80c81349429af54e5d7aa4054fb147618b0ca78eca9de28610d1051380f3cc74af0a327e55628621a3777051ea2434a4e58ab8d58341a987

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd589C.tmp\ftwjyfv.dll

Filesize
166KB

MD5
d13c3039967951f8ae2606d6f083f173

SHA1
4d0a9dadd8642e95fadaca4447f30613abd84be3

SHA256
b63d3b340fdea8034d4532f1b7548db7d1ef0cd8491b325c009b92e5c734f518

SHA512
30ee1eaea297e5142fd87e3791d4907d2ec38bd155274078d301ca00a1449825d2d278415739dfa61b6bbb24a3b2c66ecfd1f4beb9c08dd851fad6dc39b7a138

Download Submit
\Users\Admin\AppData\Local\Temp\bedfgaajca.exe

Filesize
98KB

MD5
fee9019a13538de5a3e1649fa9b7424b

SHA1
acf9d3f535163d640e4b700f8f64f1cdc2a32172

SHA256
847feb3e4ead95403ee41e3cde8bfaaacf3d9ceb1846aec036d9d8d45cf8d13e

SHA512
cf2f728796c63a31dc16e26012c77ba084495bbbb586421a6e35a389f8a8c337083a78cae4f8a0e60dcdfa565c4ec04a951cd2b8e2cec69ea842fda3a1436d1c

Download Submit
\Users\Admin\AppData\Local\Temp\bedfgaajca.exe

Filesize
342KB

MD5
0374019ce8863be6a35224d4a425b5dc

SHA1
9f88ddf03830007694b8c34df171a0b1c985b87e

SHA256
4fe3f63fecbf71229ba00f10ec49a602c9359e949e2304b4f95aeef8cec76ecd

SHA512
6b2208226aba2816401fa483740213ccb2b415e126c758693e3461187d0606af35a67f67114e856d48d7ce763c75c36b031f63c05d9de30fa47de8a2cbb2c389

Download Submit
\Users\Admin\AppData\Local\Temp\bedfgaajca.exe

Filesize
92KB

MD5
bd34773882a27e0090633808aa1c7285

SHA1
7892f37931cf60f5f48818b1b6d180e5c59df6df

SHA256
46061ccc90466833b8109e78085c43e354d0d14ef3fba143becfd37850e728ad

SHA512
9b0ea84c6c66413fc5f32a612f634fc097354ef42e7772cd89a2c2fed8288a183e9ac5b782f4054f9e82f64d706369f460ea43499fae6bae954ed6c075dc5c96

Download Submit
\Users\Admin\AppData\Local\Temp\nsd589C.tmp\ZipDLL.dll

Filesize
163KB

MD5
2dc35ddcabcb2b24919b9afae4ec3091

SHA1
9eeed33c3abc656353a7ebd1c66af38cccadd939

SHA256
6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

SHA512
0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

Download Submit