24996f3212ef5245e578102e53bfe3783fc2348ec9cd9568d3c57b7c3b533dff

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

070e3ff107ca0e216cc4c230de731ad7.exe
Size

420KB
MD5

070e3ff107ca0e216cc4c230de731ad7
SHA1

15e4a8ef29dcbb85c33eb185aecfa4e301941924
SHA256

24996f3212ef5245e578102e53bfe3783fc2348ec9cd9568d3c57b7c3b533dff
SHA512

35fc2923469bd6844caf59b01c6c2cebfde1360d04b57eeab1afa6cf3955e01577e8000a0a9d0ca9ea2089c2c610a3ed2a4e8e670aa1f3b3e377833269239583
SSDEEP

12288:4FaKZ88egt1IqqFXb3MJzttF4Ahmykdf:4FaKq+TqJb8JBtaPys

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2008	7za.exe

Loads dropped DLL 7 IoCs

pid	Process
1764	070e3ff107ca0e216cc4c230de731ad7.exe
1764	070e3ff107ca0e216cc4c230de731ad7.exe
1764	070e3ff107ca0e216cc4c230de731ad7.exe
1764	070e3ff107ca0e216cc4c230de731ad7.exe
1764	070e3ff107ca0e216cc4c230de731ad7.exe
1764	070e3ff107ca0e216cc4c230de731ad7.exe
1764	070e3ff107ca0e216cc4c230de731ad7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2368	WMIC.exe
Token: SeSecurityPrivilege	2368	WMIC.exe
Token: SeTakeOwnershipPrivilege	2368	WMIC.exe
Token: SeLoadDriverPrivilege	2368	WMIC.exe
Token: SeSystemProfilePrivilege	2368	WMIC.exe
Token: SeSystemtimePrivilege	2368	WMIC.exe
Token: SeProfSingleProcessPrivilege	2368	WMIC.exe
Token: SeIncBasePriorityPrivilege	2368	WMIC.exe
Token: SeCreatePagefilePrivilege	2368	WMIC.exe
Token: SeBackupPrivilege	2368	WMIC.exe
Token: SeRestorePrivilege	2368	WMIC.exe
Token: SeShutdownPrivilege	2368	WMIC.exe
Token: SeDebugPrivilege	2368	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2368	WMIC.exe
Token: SeRemoteShutdownPrivilege	2368	WMIC.exe
Token: SeUndockPrivilege	2368	WMIC.exe
Token: SeManageVolumePrivilege	2368	WMIC.exe
Token: 33	2368	WMIC.exe
Token: 34	2368	WMIC.exe
Token: 35	2368	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2368	WMIC.exe
Token: SeSecurityPrivilege	2368	WMIC.exe
Token: SeTakeOwnershipPrivilege	2368	WMIC.exe
Token: SeLoadDriverPrivilege	2368	WMIC.exe
Token: SeSystemProfilePrivilege	2368	WMIC.exe
Token: SeSystemtimePrivilege	2368	WMIC.exe
Token: SeProfSingleProcessPrivilege	2368	WMIC.exe
Token: SeIncBasePriorityPrivilege	2368	WMIC.exe
Token: SeCreatePagefilePrivilege	2368	WMIC.exe
Token: SeBackupPrivilege	2368	WMIC.exe
Token: SeRestorePrivilege	2368	WMIC.exe
Token: SeShutdownPrivilege	2368	WMIC.exe
Token: SeDebugPrivilege	2368	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2368	WMIC.exe
Token: SeRemoteShutdownPrivilege	2368	WMIC.exe
Token: SeUndockPrivilege	2368	WMIC.exe
Token: SeManageVolumePrivilege	2368	WMIC.exe
Token: 33	2368	WMIC.exe
Token: 34	2368	WMIC.exe
Token: 35	2368	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2736	WMIC.exe
Token: SeSecurityPrivilege	2736	WMIC.exe
Token: SeTakeOwnershipPrivilege	2736	WMIC.exe
Token: SeLoadDriverPrivilege	2736	WMIC.exe
Token: SeSystemProfilePrivilege	2736	WMIC.exe
Token: SeSystemtimePrivilege	2736	WMIC.exe
Token: SeProfSingleProcessPrivilege	2736	WMIC.exe
Token: SeIncBasePriorityPrivilege	2736	WMIC.exe
Token: SeCreatePagefilePrivilege	2736	WMIC.exe
Token: SeBackupPrivilege	2736	WMIC.exe
Token: SeRestorePrivilege	2736	WMIC.exe
Token: SeShutdownPrivilege	2736	WMIC.exe
Token: SeDebugPrivilege	2736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2736	WMIC.exe
Token: SeRemoteShutdownPrivilege	2736	WMIC.exe
Token: SeUndockPrivilege	2736	WMIC.exe
Token: SeManageVolumePrivilege	2736	WMIC.exe
Token: 33	2736	WMIC.exe
Token: 34	2736	WMIC.exe
Token: 35	2736	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2736	WMIC.exe
Token: SeSecurityPrivilege	2736	WMIC.exe
Token: SeTakeOwnershipPrivilege	2736	WMIC.exe
Token: SeLoadDriverPrivilege	2736	WMIC.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2368	1764	070e3ff107ca0e216cc4c230de731ad7.exe	28
PID 1764 wrote to memory of 2368	1764	070e3ff107ca0e216cc4c230de731ad7.exe	28
PID 1764 wrote to memory of 2368	1764	070e3ff107ca0e216cc4c230de731ad7.exe	28
PID 1764 wrote to memory of 2368	1764	070e3ff107ca0e216cc4c230de731ad7.exe	28
PID 1764 wrote to memory of 2736	1764	070e3ff107ca0e216cc4c230de731ad7.exe	31
PID 1764 wrote to memory of 2736	1764	070e3ff107ca0e216cc4c230de731ad7.exe	31
PID 1764 wrote to memory of 2736	1764	070e3ff107ca0e216cc4c230de731ad7.exe	31
PID 1764 wrote to memory of 2736	1764	070e3ff107ca0e216cc4c230de731ad7.exe	31
PID 1764 wrote to memory of 2604	1764	070e3ff107ca0e216cc4c230de731ad7.exe	33
PID 1764 wrote to memory of 2604	1764	070e3ff107ca0e216cc4c230de731ad7.exe	33
PID 1764 wrote to memory of 2604	1764	070e3ff107ca0e216cc4c230de731ad7.exe	33
PID 1764 wrote to memory of 2604	1764	070e3ff107ca0e216cc4c230de731ad7.exe	33
PID 1764 wrote to memory of 2568	1764	070e3ff107ca0e216cc4c230de731ad7.exe	35
PID 1764 wrote to memory of 2568	1764	070e3ff107ca0e216cc4c230de731ad7.exe	35
PID 1764 wrote to memory of 2568	1764	070e3ff107ca0e216cc4c230de731ad7.exe	35
PID 1764 wrote to memory of 2568	1764	070e3ff107ca0e216cc4c230de731ad7.exe	35
PID 1764 wrote to memory of 2008	1764	070e3ff107ca0e216cc4c230de731ad7.exe	37
PID 1764 wrote to memory of 2008	1764	070e3ff107ca0e216cc4c230de731ad7.exe	37
PID 1764 wrote to memory of 2008	1764	070e3ff107ca0e216cc4c230de731ad7.exe	37
PID 1764 wrote to memory of 2008	1764	070e3ff107ca0e216cc4c230de731ad7.exe	37

C:\Users\Admin\AppData\Local\Temp\070e3ff107ca0e216cc4c230de731ad7.exe
"C:\Users\Admin\AppData\Local\Temp\070e3ff107ca0e216cc4c230de731ad7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\Wbem\WMIC.exe
  WMIC csproduct Get UUID /FORMAT:textvaluelist.xsl
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\SysWOW64\Wbem\WMIC.exe
  WMIC bios Get SerialNumber /FORMAT:textvaluelist.xsl
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\SysWOW64\Wbem\WMIC.exe
  WMIC bios Get Version /FORMAT:textvaluelist.xsl
  2⤵
  PID:2604
- C:\Windows\SysWOW64\Wbem\WMIC.exe
  WMIC csproduct Get Name /FORMAT:textvaluelist.xsl
  2⤵
  PID:2568
- C:\Users\Admin\AppData\Local\Temp\nsy1096.tmp\7za.exe
  7za.exe e -y -p"62c4909d61d29db4db73faba6ad2ef9f" [RANDOM_STRING].7z
  2⤵
  - Executes dropped EXE
  PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy1096.tmp\7za.exe

Filesize
210KB

MD5
0962e485e02f382e3ab87c811f085fba

SHA1
7fa6b657af587ca171f38b9ecfb61bbd2c351ba5

SHA256
63467469bd0a9be742779d2a336baecd3320ffdbbc0475737cce97d6191d27af

SHA512
00dd9d7b85d38f1fb46575b62c06c6ef1aad7cf08ad3df4fba1b099bad51c82d02e5440ed1cded65915301ecf9afad2ad21486410bd8c362ac9d41e48ad355a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy1096.tmp\[RANDOM_STRING].7z

Filesize
225KB

MD5
f927122e02b3ece7d40659f80a02b523

SHA1
c13fd2d93c4ace0dcb391b93c474aa4a386672ac

SHA256
ed01b35f3c093f22e530627e5c8386c1b87f053586938dc3d1228f652fcc1d6f

SHA512
0e337b14c384e2fa338f70270adf625df4e5416175c3fde22e2f99f3410a59fe174493d5dbe18c09aee8b7166100dae1d1780a6892053e4002738d3e36005d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy1096.tmp\install58264.exe

Filesize
193KB

MD5
10bd2af1b07ec6bc9cd17ba512569e59

SHA1
807e17ab1b98177e135d30941b45081960d1e866

SHA256
9c620ef6eac3d0d9d3f6f2622a53d1f543cebd93846636ba397683962c07fc7c

SHA512
deacd041f12b6ec74f9e4488874ce962037990ed0ae424aaeabf2c35876b2ebbb943f92e9a4ffe504718bb00021209b035439ea4d7c64a4031b86ce9104ce3ed

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1096.tmp\7za.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1096.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit