12818cd59138995723626c288a90ff15eb2dc5df4831e77b0ff3ea67eac2a5b9

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

118a1e02ffd71e8f3b6c6424a1257ecf.exe
Size

572KB
MD5

118a1e02ffd71e8f3b6c6424a1257ecf
SHA1

4e2d477cd85e9bc9b737d8ecf0472dd741c9f5db
SHA256

12818cd59138995723626c288a90ff15eb2dc5df4831e77b0ff3ea67eac2a5b9
SHA512

5491ffbb4c21be9d2694977f8c39bdb564d411081544ddf4870dfe68078100efcc572c452d404ebb398ee835268003edaa25019d8cd3e65eceaee2eb7fbc314c
SSDEEP

12288:Lr/r8mwemQP2BBZBxhgpLG6uHziGH/txtu8ggM/:LrT59qB/HgnuT/H9bg9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2860	bcfcabffgbah.exe

Loads dropped DLL 10 IoCs

pid	Process
2356	118a1e02ffd71e8f3b6c6424a1257ecf.exe
2356	118a1e02ffd71e8f3b6c6424a1257ecf.exe
2356	118a1e02ffd71e8f3b6c6424a1257ecf.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
596	2860	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2928	wmic.exe
Token: SeSecurityPrivilege	2928	wmic.exe
Token: SeTakeOwnershipPrivilege	2928	wmic.exe
Token: SeLoadDriverPrivilege	2928	wmic.exe
Token: SeSystemProfilePrivilege	2928	wmic.exe
Token: SeSystemtimePrivilege	2928	wmic.exe
Token: SeProfSingleProcessPrivilege	2928	wmic.exe
Token: SeIncBasePriorityPrivilege	2928	wmic.exe
Token: SeCreatePagefilePrivilege	2928	wmic.exe
Token: SeBackupPrivilege	2928	wmic.exe
Token: SeRestorePrivilege	2928	wmic.exe
Token: SeShutdownPrivilege	2928	wmic.exe
Token: SeDebugPrivilege	2928	wmic.exe
Token: SeSystemEnvironmentPrivilege	2928	wmic.exe
Token: SeRemoteShutdownPrivilege	2928	wmic.exe
Token: SeUndockPrivilege	2928	wmic.exe
Token: SeManageVolumePrivilege	2928	wmic.exe
Token: 33	2928	wmic.exe
Token: 34	2928	wmic.exe
Token: 35	2928	wmic.exe
Token: SeIncreaseQuotaPrivilege	2928	wmic.exe
Token: SeSecurityPrivilege	2928	wmic.exe
Token: SeTakeOwnershipPrivilege	2928	wmic.exe
Token: SeLoadDriverPrivilege	2928	wmic.exe
Token: SeSystemProfilePrivilege	2928	wmic.exe
Token: SeSystemtimePrivilege	2928	wmic.exe
Token: SeProfSingleProcessPrivilege	2928	wmic.exe
Token: SeIncBasePriorityPrivilege	2928	wmic.exe
Token: SeCreatePagefilePrivilege	2928	wmic.exe
Token: SeBackupPrivilege	2928	wmic.exe
Token: SeRestorePrivilege	2928	wmic.exe
Token: SeShutdownPrivilege	2928	wmic.exe
Token: SeDebugPrivilege	2928	wmic.exe
Token: SeSystemEnvironmentPrivilege	2928	wmic.exe
Token: SeRemoteShutdownPrivilege	2928	wmic.exe
Token: SeUndockPrivilege	2928	wmic.exe
Token: SeManageVolumePrivilege	2928	wmic.exe
Token: 33	2928	wmic.exe
Token: 34	2928	wmic.exe
Token: 35	2928	wmic.exe
Token: SeIncreaseQuotaPrivilege	1812	wmic.exe
Token: SeSecurityPrivilege	1812	wmic.exe
Token: SeTakeOwnershipPrivilege	1812	wmic.exe
Token: SeLoadDriverPrivilege	1812	wmic.exe
Token: SeSystemProfilePrivilege	1812	wmic.exe
Token: SeSystemtimePrivilege	1812	wmic.exe
Token: SeProfSingleProcessPrivilege	1812	wmic.exe
Token: SeIncBasePriorityPrivilege	1812	wmic.exe
Token: SeCreatePagefilePrivilege	1812	wmic.exe
Token: SeBackupPrivilege	1812	wmic.exe
Token: SeRestorePrivilege	1812	wmic.exe
Token: SeShutdownPrivilege	1812	wmic.exe
Token: SeDebugPrivilege	1812	wmic.exe
Token: SeSystemEnvironmentPrivilege	1812	wmic.exe
Token: SeRemoteShutdownPrivilege	1812	wmic.exe
Token: SeUndockPrivilege	1812	wmic.exe
Token: SeManageVolumePrivilege	1812	wmic.exe
Token: 33	1812	wmic.exe
Token: 34	1812	wmic.exe
Token: 35	1812	wmic.exe
Token: SeIncreaseQuotaPrivilege	2644	wmic.exe
Token: SeSecurityPrivilege	2644	wmic.exe
Token: SeTakeOwnershipPrivilege	2644	wmic.exe
Token: SeLoadDriverPrivilege	2644	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2860	2356	118a1e02ffd71e8f3b6c6424a1257ecf.exe	28
PID 2356 wrote to memory of 2860	2356	118a1e02ffd71e8f3b6c6424a1257ecf.exe	28
PID 2356 wrote to memory of 2860	2356	118a1e02ffd71e8f3b6c6424a1257ecf.exe	28
PID 2356 wrote to memory of 2860	2356	118a1e02ffd71e8f3b6c6424a1257ecf.exe	28
PID 2860 wrote to memory of 2928	2860	bcfcabffgbah.exe	29
PID 2860 wrote to memory of 2928	2860	bcfcabffgbah.exe	29
PID 2860 wrote to memory of 2928	2860	bcfcabffgbah.exe	29
PID 2860 wrote to memory of 2928	2860	bcfcabffgbah.exe	29
PID 2860 wrote to memory of 1812	2860	bcfcabffgbah.exe	32
PID 2860 wrote to memory of 1812	2860	bcfcabffgbah.exe	32
PID 2860 wrote to memory of 1812	2860	bcfcabffgbah.exe	32
PID 2860 wrote to memory of 1812	2860	bcfcabffgbah.exe	32
PID 2860 wrote to memory of 2644	2860	bcfcabffgbah.exe	34
PID 2860 wrote to memory of 2644	2860	bcfcabffgbah.exe	34
PID 2860 wrote to memory of 2644	2860	bcfcabffgbah.exe	34
PID 2860 wrote to memory of 2644	2860	bcfcabffgbah.exe	34
PID 2860 wrote to memory of 2660	2860	bcfcabffgbah.exe	36
PID 2860 wrote to memory of 2660	2860	bcfcabffgbah.exe	36
PID 2860 wrote to memory of 2660	2860	bcfcabffgbah.exe	36
PID 2860 wrote to memory of 2660	2860	bcfcabffgbah.exe	36
PID 2860 wrote to memory of 2472	2860	bcfcabffgbah.exe	38
PID 2860 wrote to memory of 2472	2860	bcfcabffgbah.exe	38
PID 2860 wrote to memory of 2472	2860	bcfcabffgbah.exe	38
PID 2860 wrote to memory of 2472	2860	bcfcabffgbah.exe	38
PID 2860 wrote to memory of 596	2860	bcfcabffgbah.exe	40
PID 2860 wrote to memory of 596	2860	bcfcabffgbah.exe	40
PID 2860 wrote to memory of 596	2860	bcfcabffgbah.exe	40
PID 2860 wrote to memory of 596	2860	bcfcabffgbah.exe	40

C:\Users\Admin\AppData\Local\Temp\118a1e02ffd71e8f3b6c6424a1257ecf.exe
"C:\Users\Admin\AppData\Local\Temp\118a1e02ffd71e8f3b6c6424a1257ecf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\bcfcabffgbah.exe
  C:\Users\Admin\AppData\Local\Temp\bcfcabffgbah.exe 2-1-8-7-3-9-0-8-8-7-4 LU9BPToqMCoqGStRVDpJRjs9KBgoSkNTT0hPQkk8NSkcLUNBTFFARDUqLTIuMBgoQEBENSgZK05RRz1SOlRXQT05LzUxLR0mUz1KT0FQXk1LSTRobGxpNi0ua15vbS5sYF4pX29oJmFYdFkmYmpkbhgoQENJO0NCQDt2Oj4zQzFLTUxCMkVFTkk/MERITkNSRUEZLDsxNSssMzQzKRksOzI1JSocLUMrNiooICc8LTkrMBgoQSw9JSkZK05RRz1SOlRXSEtFVEA7UjoXL0hKSEBTQkxYQkxMOTUZK05RRz1SOlRXRjpJQzwYKEJPRVdNS0g7Hyc+VTxfO0U9SEdNPTYdJkhHS01bQFFHUFA8UjUqGStSRzlHSFBPTVdOTko8GChTRD0qGChAUTA1GSxJVUZMQklDXk8+STpPRT1CST9GPU5PQz0YJ0JPXVFNR1FATT01bW5zZBgoTzxUTUpHRUxGV05QPFJXPDpVUTwqGSw/STw9UTkvHydCUFZEUUY6SUdCVz5LOlJRSE1BQjxeWmlqZRgnPUtVTURIPjtfQUg2MzUtLCcuLDMmKi0zHi5MQko8PSksKy4vOC4tNi4gJzxIU0xLRzpBVlRBRT45Ly4qLiwpMCktIy44MiwzMi4qSEU=
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704092241.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704092241.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704092241.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704092241.txt bios get version
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704092241.txt bios get version
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 372
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81704092241.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5497.tmp\jor.dll

Filesize
108KB

MD5
adfc62915782f9450deb70e4a472e589

SHA1
0ecf83be0eb3804902186d80a90e4065cc5c6076

SHA256
f8cd299aad5fff62817f712fd677cffd7466b1dc4ea060a1d54738094bc40b02

SHA512
007552c2a38285ff2400d0a1a5214151a5edb897a2eb1a23b85601f678fbcc2ee3cd77e957e6b74e200718577e2445949f2b992be3be485129ff552be5c0fb4d

Download Submit
\Users\Admin\AppData\Local\Temp\bcfcabffgbah.exe

Filesize
822KB

MD5
f2dde555bc99ecf56391030c7d26ad15

SHA1
eedc35ea7c25cf65ed814fedb68837061aa7ee11

SHA256
f5718c42adaddafcb1e7d1f82ec0284d65a7272cb90f2b2359888e4d25c76474

SHA512
86483493d3c05ff33eca97e5f1b0a828dd5eec7bbea1f9aedd96491489955aa22ae31eef886d32ad6389c6e3e9a2ab5a02303417fe3b6c0682a8b156203774fc

Download Submit
\Users\Admin\AppData\Local\Temp\nso5497.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit