11cbec36b4b1387a0204d5236c42e40a188699245dbdfa554295ef6b85966d88

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ead832b0c137a7af0f73d361b0b8ece.exe
Size

620KB
MD5

0ead832b0c137a7af0f73d361b0b8ece
SHA1

4d6848dffe205363d973d843f08f189994d2b102
SHA256

11cbec36b4b1387a0204d5236c42e40a188699245dbdfa554295ef6b85966d88
SHA512

64e8c96e2c0185c860cf823f01aca57425c31476a36345b3d7e269feb7eaa6a1b15e6a63aaabf8be4fcbb993460c17da53aec2acdcc5ce7faac4235d063f8a94
SSDEEP

12288:i3X0clFdNeED/dxR6VXluJQqYU1g5w5Thk/H5ihf8F/fc8vy4h:i3EcLdZD/908JrKw5T2cmM86

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2768	sd.exe

Loads dropped DLL 10 IoCs

pid	Process
1940	0ead832b0c137a7af0f73d361b0b8ece.exe
1940	0ead832b0c137a7af0f73d361b0b8ece.exe
1940	0ead832b0c137a7af0f73d361b0b8ece.exe
1528	WerFault.exe
1528	WerFault.exe
1528	WerFault.exe
1528	WerFault.exe
1528	WerFault.exe
1528	WerFault.exe
1528	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1528	2768	WerFault.exe	28

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sd.exe"	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0"	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sd.exe"	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals"	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sd.exe\""	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\ = "SmartInstallerLib"	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version\ = "1.0"	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS\ = "0"	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals"	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\ = "CBrowserExternal Class"	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Programmable	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	sd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}	sd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0"	sd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2756	wmic.exe
Token: SeSecurityPrivilege	2756	wmic.exe
Token: SeTakeOwnershipPrivilege	2756	wmic.exe
Token: SeLoadDriverPrivilege	2756	wmic.exe
Token: SeSystemProfilePrivilege	2756	wmic.exe
Token: SeSystemtimePrivilege	2756	wmic.exe
Token: SeProfSingleProcessPrivilege	2756	wmic.exe
Token: SeIncBasePriorityPrivilege	2756	wmic.exe
Token: SeCreatePagefilePrivilege	2756	wmic.exe
Token: SeBackupPrivilege	2756	wmic.exe
Token: SeRestorePrivilege	2756	wmic.exe
Token: SeShutdownPrivilege	2756	wmic.exe
Token: SeDebugPrivilege	2756	wmic.exe
Token: SeSystemEnvironmentPrivilege	2756	wmic.exe
Token: SeRemoteShutdownPrivilege	2756	wmic.exe
Token: SeUndockPrivilege	2756	wmic.exe
Token: SeManageVolumePrivilege	2756	wmic.exe
Token: 33	2756	wmic.exe
Token: 34	2756	wmic.exe
Token: 35	2756	wmic.exe
Token: SeIncreaseQuotaPrivilege	2756	wmic.exe
Token: SeSecurityPrivilege	2756	wmic.exe
Token: SeTakeOwnershipPrivilege	2756	wmic.exe
Token: SeLoadDriverPrivilege	2756	wmic.exe
Token: SeSystemProfilePrivilege	2756	wmic.exe
Token: SeSystemtimePrivilege	2756	wmic.exe
Token: SeProfSingleProcessPrivilege	2756	wmic.exe
Token: SeIncBasePriorityPrivilege	2756	wmic.exe
Token: SeCreatePagefilePrivilege	2756	wmic.exe
Token: SeBackupPrivilege	2756	wmic.exe
Token: SeRestorePrivilege	2756	wmic.exe
Token: SeShutdownPrivilege	2756	wmic.exe
Token: SeDebugPrivilege	2756	wmic.exe
Token: SeSystemEnvironmentPrivilege	2756	wmic.exe
Token: SeRemoteShutdownPrivilege	2756	wmic.exe
Token: SeUndockPrivilege	2756	wmic.exe
Token: SeManageVolumePrivilege	2756	wmic.exe
Token: 33	2756	wmic.exe
Token: 34	2756	wmic.exe
Token: 35	2756	wmic.exe
Token: SeIncreaseQuotaPrivilege	2616	wmic.exe
Token: SeSecurityPrivilege	2616	wmic.exe
Token: SeTakeOwnershipPrivilege	2616	wmic.exe
Token: SeLoadDriverPrivilege	2616	wmic.exe
Token: SeSystemProfilePrivilege	2616	wmic.exe
Token: SeSystemtimePrivilege	2616	wmic.exe
Token: SeProfSingleProcessPrivilege	2616	wmic.exe
Token: SeIncBasePriorityPrivilege	2616	wmic.exe
Token: SeCreatePagefilePrivilege	2616	wmic.exe
Token: SeBackupPrivilege	2616	wmic.exe
Token: SeRestorePrivilege	2616	wmic.exe
Token: SeShutdownPrivilege	2616	wmic.exe
Token: SeDebugPrivilege	2616	wmic.exe
Token: SeSystemEnvironmentPrivilege	2616	wmic.exe
Token: SeRemoteShutdownPrivilege	2616	wmic.exe
Token: SeUndockPrivilege	2616	wmic.exe
Token: SeManageVolumePrivilege	2616	wmic.exe
Token: 33	2616	wmic.exe
Token: 34	2616	wmic.exe
Token: 35	2616	wmic.exe
Token: SeIncreaseQuotaPrivilege	2576	wmic.exe
Token: SeSecurityPrivilege	2576	wmic.exe
Token: SeTakeOwnershipPrivilege	2576	wmic.exe
Token: SeLoadDriverPrivilege	2576	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2768	1940	0ead832b0c137a7af0f73d361b0b8ece.exe	28
PID 1940 wrote to memory of 2768	1940	0ead832b0c137a7af0f73d361b0b8ece.exe	28
PID 1940 wrote to memory of 2768	1940	0ead832b0c137a7af0f73d361b0b8ece.exe	28
PID 1940 wrote to memory of 2768	1940	0ead832b0c137a7af0f73d361b0b8ece.exe	28
PID 2768 wrote to memory of 2756	2768	sd.exe	29
PID 2768 wrote to memory of 2756	2768	sd.exe	29
PID 2768 wrote to memory of 2756	2768	sd.exe	29
PID 2768 wrote to memory of 2756	2768	sd.exe	29
PID 2768 wrote to memory of 2616	2768	sd.exe	32
PID 2768 wrote to memory of 2616	2768	sd.exe	32
PID 2768 wrote to memory of 2616	2768	sd.exe	32
PID 2768 wrote to memory of 2616	2768	sd.exe	32
PID 2768 wrote to memory of 2576	2768	sd.exe	34
PID 2768 wrote to memory of 2576	2768	sd.exe	34
PID 2768 wrote to memory of 2576	2768	sd.exe	34
PID 2768 wrote to memory of 2576	2768	sd.exe	34
PID 2768 wrote to memory of 3016	2768	sd.exe	37
PID 2768 wrote to memory of 3016	2768	sd.exe	37
PID 2768 wrote to memory of 3016	2768	sd.exe	37
PID 2768 wrote to memory of 3016	2768	sd.exe	37
PID 2768 wrote to memory of 1016	2768	sd.exe	38
PID 2768 wrote to memory of 1016	2768	sd.exe	38
PID 2768 wrote to memory of 1016	2768	sd.exe	38
PID 2768 wrote to memory of 1016	2768	sd.exe	38
PID 2768 wrote to memory of 1528	2768	sd.exe	40
PID 2768 wrote to memory of 1528	2768	sd.exe	40
PID 2768 wrote to memory of 1528	2768	sd.exe	40
PID 2768 wrote to memory of 1528	2768	sd.exe	40

C:\Users\Admin\AppData\Local\Temp\0ead832b0c137a7af0f73d361b0b8ece.exe
"C:\Users\Admin\AppData\Local\Temp\0ead832b0c137a7af0f73d361b0b8ece.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\sd.exe
  C:\Users\Admin\AppData\Local\Temp\sd.exe /PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wIINSQOVTSSJVSLDGVK5461I /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407441920 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\log.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\log.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\log.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\log.txt bios get version
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\log.txt bios get version
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 372
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\log.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\nsd93B8.tmp\Convert.dll

Filesize
114KB

MD5
9cba81af66fd1cbd7a72eef1e2c535fd

SHA1
8106584623b3aba01c65924ac5f7fa676ccb56de

SHA256
9c397a4d0b58a23784cb051c9ab4512fc8ad30c68ce8f3c722dd01b09e9b2445

SHA512
dc0495dc83500efc38cd2e7221c2b76cd9f0dc53f2f09d1611594f26d8589bef121d23ea061de7087ac280e366bebbe7720b23facbd7aa5ae7e1207ac8547e19

Download Submit
\Users\Admin\AppData\Local\Temp\nsd93B8.tmp\ZipDLL.dll

Filesize
163KB

MD5
2dc35ddcabcb2b24919b9afae4ec3091

SHA1
9eeed33c3abc656353a7ebd1c66af38cccadd939

SHA256
6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

SHA512
0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

Download Submit
\Users\Admin\AppData\Local\Temp\sd.exe

Filesize
796KB

MD5
09fc243d556cd7bd32a8e954a2790f01

SHA1
f75f3f5a5c2d73b98ee1240e8ac47b504b0045ca

SHA256
424ec1651191436a35008668b0200653a821bf76086c99f252e31ffca9511a6c

SHA512
99c9d62dd189f471ee1bfdd816df3cdd8442338aa92fb2bb377cc94e60e36516836ef942e1c3db74d329c89cb740823131849b26ad0c2718a079b4caf7310081

Download Submit