Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 21:11

General

  • Target

    1c943a71adaecce1bf7b424e11563c87.exe

  • Size

    920KB

  • MD5

    1c943a71adaecce1bf7b424e11563c87

  • SHA1

    b41c59594653625092b6b1e5edb64ba74f35dcb9

  • SHA256

    06a951be886b3b276e79d7657afc1d6adf3ccf9edc64704a31c74dad0a63f9f7

  • SHA512

    06b4dde1da068b339754d8aa7528409422facd59393a6b4f9ce71a6bbb11a589d160cb4c2ce89dacc369cedbf94e59261b6b32a2036b7532e3d74aef16abf5b6

  • SSDEEP

    24576:YeHXdyZNrNF/4lgGhpwJxmntY1VKc9IsTELQ:3HXc3BqXp6fScKsIL

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c943a71adaecce1bf7b424e11563c87.exe
    "C:\Users\Admin\AppData\Local\Temp\1c943a71adaecce1bf7b424e11563c87.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Users\Admin\AppData\Local\Temp\f.exe
      C:\Users\Admin\AppData\Local\Temp\f.exe /PID=7302 /SUBPID=-1 /DISTID=1775 /NETWORKID=0 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=808931009 /D1=14321 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=2
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2756
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2664
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2520
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
        3⤵
          PID:2648
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
          3⤵
            PID:2152
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 364
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:268

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\obhhelper.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\f.exe

        Filesize

        1.3MB

        MD5

        87871727eea84770fe6f4f3ff7d2e334

        SHA1

        ab0a82f0c59daebdeb0d094edb0709708093df2b

        SHA256

        13c16041165c7e4d146d7ea6f256440359b230bbb62472444cc0d422859bb237

        SHA512

        a7a700a68551e9aa4694265cc3a55b59cc72b93d7ba0997cad380d142e0b89093763505eee777efe8bc8dbfe6f19738f2764f6d75fc0547dc3e41ab00653a9dd

      • \Users\Admin\AppData\Local\Temp\nsy534F.tmp\System.dll

        Filesize

        11KB

        MD5

        c17103ae9072a06da581dec998343fc1

        SHA1

        b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

        SHA256

        dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

        SHA512

        d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f