Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 21:11
Static task
static1
Behavioral task
behavioral1
Sample
1c943a71adaecce1bf7b424e11563c87.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1c943a71adaecce1bf7b424e11563c87.exe
Resource
win10v2004-20231222-en
General
-
Target
1c943a71adaecce1bf7b424e11563c87.exe
-
Size
920KB
-
MD5
1c943a71adaecce1bf7b424e11563c87
-
SHA1
b41c59594653625092b6b1e5edb64ba74f35dcb9
-
SHA256
06a951be886b3b276e79d7657afc1d6adf3ccf9edc64704a31c74dad0a63f9f7
-
SHA512
06b4dde1da068b339754d8aa7528409422facd59393a6b4f9ce71a6bbb11a589d160cb4c2ce89dacc369cedbf94e59261b6b32a2036b7532e3d74aef16abf5b6
-
SSDEEP
24576:YeHXdyZNrNF/4lgGhpwJxmntY1VKc9IsTELQ:3HXc3BqXp6fScKsIL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2676 f.exe -
Loads dropped DLL 10 IoCs
pid Process 2172 1c943a71adaecce1bf7b424e11563c87.exe 2172 1c943a71adaecce1bf7b424e11563c87.exe 2172 1c943a71adaecce1bf7b424e11563c87.exe 268 WerFault.exe 268 WerFault.exe 268 WerFault.exe 268 WerFault.exe 268 WerFault.exe 268 WerFault.exe 268 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 268 2676 WerFault.exe 28 -
Modifies registry class 34 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32 f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5} f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0 f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982} f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe\"" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534} f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534} f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\ = "CBrowserExternal Class" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Programmable f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version\ = "1.0" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\ = "SmartInstallerLib" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS\ = "0" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2756 wmic.exe Token: SeSecurityPrivilege 2756 wmic.exe Token: SeTakeOwnershipPrivilege 2756 wmic.exe Token: SeLoadDriverPrivilege 2756 wmic.exe Token: SeSystemProfilePrivilege 2756 wmic.exe Token: SeSystemtimePrivilege 2756 wmic.exe Token: SeProfSingleProcessPrivilege 2756 wmic.exe Token: SeIncBasePriorityPrivilege 2756 wmic.exe Token: SeCreatePagefilePrivilege 2756 wmic.exe Token: SeBackupPrivilege 2756 wmic.exe Token: SeRestorePrivilege 2756 wmic.exe Token: SeShutdownPrivilege 2756 wmic.exe Token: SeDebugPrivilege 2756 wmic.exe Token: SeSystemEnvironmentPrivilege 2756 wmic.exe Token: SeRemoteShutdownPrivilege 2756 wmic.exe Token: SeUndockPrivilege 2756 wmic.exe Token: SeManageVolumePrivilege 2756 wmic.exe Token: 33 2756 wmic.exe Token: 34 2756 wmic.exe Token: 35 2756 wmic.exe Token: SeIncreaseQuotaPrivilege 2756 wmic.exe Token: SeSecurityPrivilege 2756 wmic.exe Token: SeTakeOwnershipPrivilege 2756 wmic.exe Token: SeLoadDriverPrivilege 2756 wmic.exe Token: SeSystemProfilePrivilege 2756 wmic.exe Token: SeSystemtimePrivilege 2756 wmic.exe Token: SeProfSingleProcessPrivilege 2756 wmic.exe Token: SeIncBasePriorityPrivilege 2756 wmic.exe Token: SeCreatePagefilePrivilege 2756 wmic.exe Token: SeBackupPrivilege 2756 wmic.exe Token: SeRestorePrivilege 2756 wmic.exe Token: SeShutdownPrivilege 2756 wmic.exe Token: SeDebugPrivilege 2756 wmic.exe Token: SeSystemEnvironmentPrivilege 2756 wmic.exe Token: SeRemoteShutdownPrivilege 2756 wmic.exe Token: SeUndockPrivilege 2756 wmic.exe Token: SeManageVolumePrivilege 2756 wmic.exe Token: 33 2756 wmic.exe Token: 34 2756 wmic.exe Token: 35 2756 wmic.exe Token: SeIncreaseQuotaPrivilege 2664 wmic.exe Token: SeSecurityPrivilege 2664 wmic.exe Token: SeTakeOwnershipPrivilege 2664 wmic.exe Token: SeLoadDriverPrivilege 2664 wmic.exe Token: SeSystemProfilePrivilege 2664 wmic.exe Token: SeSystemtimePrivilege 2664 wmic.exe Token: SeProfSingleProcessPrivilege 2664 wmic.exe Token: SeIncBasePriorityPrivilege 2664 wmic.exe Token: SeCreatePagefilePrivilege 2664 wmic.exe Token: SeBackupPrivilege 2664 wmic.exe Token: SeRestorePrivilege 2664 wmic.exe Token: SeShutdownPrivilege 2664 wmic.exe Token: SeDebugPrivilege 2664 wmic.exe Token: SeSystemEnvironmentPrivilege 2664 wmic.exe Token: SeRemoteShutdownPrivilege 2664 wmic.exe Token: SeUndockPrivilege 2664 wmic.exe Token: SeManageVolumePrivilege 2664 wmic.exe Token: 33 2664 wmic.exe Token: 34 2664 wmic.exe Token: 35 2664 wmic.exe Token: SeIncreaseQuotaPrivilege 2520 wmic.exe Token: SeSecurityPrivilege 2520 wmic.exe Token: SeTakeOwnershipPrivilege 2520 wmic.exe Token: SeLoadDriverPrivilege 2520 wmic.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2676 2172 1c943a71adaecce1bf7b424e11563c87.exe 28 PID 2172 wrote to memory of 2676 2172 1c943a71adaecce1bf7b424e11563c87.exe 28 PID 2172 wrote to memory of 2676 2172 1c943a71adaecce1bf7b424e11563c87.exe 28 PID 2172 wrote to memory of 2676 2172 1c943a71adaecce1bf7b424e11563c87.exe 28 PID 2172 wrote to memory of 2676 2172 1c943a71adaecce1bf7b424e11563c87.exe 28 PID 2172 wrote to memory of 2676 2172 1c943a71adaecce1bf7b424e11563c87.exe 28 PID 2172 wrote to memory of 2676 2172 1c943a71adaecce1bf7b424e11563c87.exe 28 PID 2676 wrote to memory of 2756 2676 f.exe 29 PID 2676 wrote to memory of 2756 2676 f.exe 29 PID 2676 wrote to memory of 2756 2676 f.exe 29 PID 2676 wrote to memory of 2756 2676 f.exe 29 PID 2676 wrote to memory of 2664 2676 f.exe 33 PID 2676 wrote to memory of 2664 2676 f.exe 33 PID 2676 wrote to memory of 2664 2676 f.exe 33 PID 2676 wrote to memory of 2664 2676 f.exe 33 PID 2676 wrote to memory of 2520 2676 f.exe 34 PID 2676 wrote to memory of 2520 2676 f.exe 34 PID 2676 wrote to memory of 2520 2676 f.exe 34 PID 2676 wrote to memory of 2520 2676 f.exe 34 PID 2676 wrote to memory of 2648 2676 f.exe 36 PID 2676 wrote to memory of 2648 2676 f.exe 36 PID 2676 wrote to memory of 2648 2676 f.exe 36 PID 2676 wrote to memory of 2648 2676 f.exe 36 PID 2676 wrote to memory of 2152 2676 f.exe 38 PID 2676 wrote to memory of 2152 2676 f.exe 38 PID 2676 wrote to memory of 2152 2676 f.exe 38 PID 2676 wrote to memory of 2152 2676 f.exe 38 PID 2676 wrote to memory of 268 2676 f.exe 40 PID 2676 wrote to memory of 268 2676 f.exe 40 PID 2676 wrote to memory of 268 2676 f.exe 40 PID 2676 wrote to memory of 268 2676 f.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c943a71adaecce1bf7b424e11563c87.exe"C:\Users\Admin\AppData\Local\Temp\1c943a71adaecce1bf7b424e11563c87.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\f.exeC:\Users\Admin\AppData\Local\Temp\f.exe /PID=7302 /SUBPID=-1 /DISTID=1775 /NETWORKID=0 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=808931009 /D1=14321 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵PID:2648
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵PID:2152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 3643⤵
- Loads dropped DLL
- Program crash
PID:268
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
1.3MB
MD587871727eea84770fe6f4f3ff7d2e334
SHA1ab0a82f0c59daebdeb0d094edb0709708093df2b
SHA25613c16041165c7e4d146d7ea6f256440359b230bbb62472444cc0d422859bb237
SHA512a7a700a68551e9aa4694265cc3a55b59cc72b93d7ba0997cad380d142e0b89093763505eee777efe8bc8dbfe6f19738f2764f6d75fc0547dc3e41ab00653a9dd
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f