f3459c1261078b4c3c1b5c9045f2bc3a1a43522ceaecd3ead28a2aa952b5794c

Analysis

max time kernel
117s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

217ebd8064afe605787d5e2075fdd3dd.exe
Size

698KB
MD5

217ebd8064afe605787d5e2075fdd3dd
SHA1

e105e719427f847eff6afe30d1626699729d169a
SHA256

f3459c1261078b4c3c1b5c9045f2bc3a1a43522ceaecd3ead28a2aa952b5794c
SHA512

2b81eae0e4ccac587a0103de3a3046985e71e2bf2c962ca60f991af00f09e0a8ffa01f660f08c13af398cd70582505940fda2387e77e9740e972cfe4d6b88c15
SSDEEP

12288:47D3AXrtoYYmphN2PEqibCISU6PzC5yMFURpgOgwfKkiSOb1erU9JgjgI:47sXrRY4hN2cqi2IqzqUROQfKkiSORwj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2920	cbgcabfifcca.exe

Loads dropped DLL 10 IoCs

pid	Process
2700	217ebd8064afe605787d5e2075fdd3dd.exe
2700	217ebd8064afe605787d5e2075fdd3dd.exe
2700	217ebd8064afe605787d5e2075fdd3dd.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	2920	WerFault.exe	29

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2004	wmic.exe
Token: SeSecurityPrivilege	2004	wmic.exe
Token: SeTakeOwnershipPrivilege	2004	wmic.exe
Token: SeLoadDriverPrivilege	2004	wmic.exe
Token: SeSystemProfilePrivilege	2004	wmic.exe
Token: SeSystemtimePrivilege	2004	wmic.exe
Token: SeProfSingleProcessPrivilege	2004	wmic.exe
Token: SeIncBasePriorityPrivilege	2004	wmic.exe
Token: SeCreatePagefilePrivilege	2004	wmic.exe
Token: SeBackupPrivilege	2004	wmic.exe
Token: SeRestorePrivilege	2004	wmic.exe
Token: SeShutdownPrivilege	2004	wmic.exe
Token: SeDebugPrivilege	2004	wmic.exe
Token: SeSystemEnvironmentPrivilege	2004	wmic.exe
Token: SeRemoteShutdownPrivilege	2004	wmic.exe
Token: SeUndockPrivilege	2004	wmic.exe
Token: SeManageVolumePrivilege	2004	wmic.exe
Token: 33	2004	wmic.exe
Token: 34	2004	wmic.exe
Token: 35	2004	wmic.exe
Token: SeIncreaseQuotaPrivilege	2004	wmic.exe
Token: SeSecurityPrivilege	2004	wmic.exe
Token: SeTakeOwnershipPrivilege	2004	wmic.exe
Token: SeLoadDriverPrivilege	2004	wmic.exe
Token: SeSystemProfilePrivilege	2004	wmic.exe
Token: SeSystemtimePrivilege	2004	wmic.exe
Token: SeProfSingleProcessPrivilege	2004	wmic.exe
Token: SeIncBasePriorityPrivilege	2004	wmic.exe
Token: SeCreatePagefilePrivilege	2004	wmic.exe
Token: SeBackupPrivilege	2004	wmic.exe
Token: SeRestorePrivilege	2004	wmic.exe
Token: SeShutdownPrivilege	2004	wmic.exe
Token: SeDebugPrivilege	2004	wmic.exe
Token: SeSystemEnvironmentPrivilege	2004	wmic.exe
Token: SeRemoteShutdownPrivilege	2004	wmic.exe
Token: SeUndockPrivilege	2004	wmic.exe
Token: SeManageVolumePrivilege	2004	wmic.exe
Token: 33	2004	wmic.exe
Token: 34	2004	wmic.exe
Token: 35	2004	wmic.exe
Token: SeIncreaseQuotaPrivilege	1664	wmic.exe
Token: SeSecurityPrivilege	1664	wmic.exe
Token: SeTakeOwnershipPrivilege	1664	wmic.exe
Token: SeLoadDriverPrivilege	1664	wmic.exe
Token: SeSystemProfilePrivilege	1664	wmic.exe
Token: SeSystemtimePrivilege	1664	wmic.exe
Token: SeProfSingleProcessPrivilege	1664	wmic.exe
Token: SeIncBasePriorityPrivilege	1664	wmic.exe
Token: SeCreatePagefilePrivilege	1664	wmic.exe
Token: SeBackupPrivilege	1664	wmic.exe
Token: SeRestorePrivilege	1664	wmic.exe
Token: SeShutdownPrivilege	1664	wmic.exe
Token: SeDebugPrivilege	1664	wmic.exe
Token: SeSystemEnvironmentPrivilege	1664	wmic.exe
Token: SeRemoteShutdownPrivilege	1664	wmic.exe
Token: SeUndockPrivilege	1664	wmic.exe
Token: SeManageVolumePrivilege	1664	wmic.exe
Token: 33	1664	wmic.exe
Token: 34	1664	wmic.exe
Token: 35	1664	wmic.exe
Token: SeIncreaseQuotaPrivilege	1664	wmic.exe
Token: SeSecurityPrivilege	1664	wmic.exe
Token: SeTakeOwnershipPrivilege	1664	wmic.exe
Token: SeLoadDriverPrivilege	1664	wmic.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2920	2700	217ebd8064afe605787d5e2075fdd3dd.exe	29
PID 2700 wrote to memory of 2920	2700	217ebd8064afe605787d5e2075fdd3dd.exe	29
PID 2700 wrote to memory of 2920	2700	217ebd8064afe605787d5e2075fdd3dd.exe	29
PID 2700 wrote to memory of 2920	2700	217ebd8064afe605787d5e2075fdd3dd.exe	29
PID 2700 wrote to memory of 2920	2700	217ebd8064afe605787d5e2075fdd3dd.exe	29
PID 2700 wrote to memory of 2920	2700	217ebd8064afe605787d5e2075fdd3dd.exe	29
PID 2700 wrote to memory of 2920	2700	217ebd8064afe605787d5e2075fdd3dd.exe	29
PID 2920 wrote to memory of 2004	2920	cbgcabfifcca.exe	30
PID 2920 wrote to memory of 2004	2920	cbgcabfifcca.exe	30
PID 2920 wrote to memory of 2004	2920	cbgcabfifcca.exe	30
PID 2920 wrote to memory of 2004	2920	cbgcabfifcca.exe	30
PID 2920 wrote to memory of 1664	2920	cbgcabfifcca.exe	33
PID 2920 wrote to memory of 1664	2920	cbgcabfifcca.exe	33
PID 2920 wrote to memory of 1664	2920	cbgcabfifcca.exe	33
PID 2920 wrote to memory of 1664	2920	cbgcabfifcca.exe	33
PID 2920 wrote to memory of 1976	2920	cbgcabfifcca.exe	35
PID 2920 wrote to memory of 1976	2920	cbgcabfifcca.exe	35
PID 2920 wrote to memory of 1976	2920	cbgcabfifcca.exe	35
PID 2920 wrote to memory of 1976	2920	cbgcabfifcca.exe	35
PID 2920 wrote to memory of 1236	2920	cbgcabfifcca.exe	38
PID 2920 wrote to memory of 1236	2920	cbgcabfifcca.exe	38
PID 2920 wrote to memory of 1236	2920	cbgcabfifcca.exe	38
PID 2920 wrote to memory of 1236	2920	cbgcabfifcca.exe	38
PID 2920 wrote to memory of 2052	2920	cbgcabfifcca.exe	39
PID 2920 wrote to memory of 2052	2920	cbgcabfifcca.exe	39
PID 2920 wrote to memory of 2052	2920	cbgcabfifcca.exe	39
PID 2920 wrote to memory of 2052	2920	cbgcabfifcca.exe	39
PID 2920 wrote to memory of 3036	2920	cbgcabfifcca.exe	41
PID 2920 wrote to memory of 3036	2920	cbgcabfifcca.exe	41
PID 2920 wrote to memory of 3036	2920	cbgcabfifcca.exe	41
PID 2920 wrote to memory of 3036	2920	cbgcabfifcca.exe	41

C:\Users\Admin\AppData\Local\Temp\217ebd8064afe605787d5e2075fdd3dd.exe
"C:\Users\Admin\AppData\Local\Temp\217ebd8064afe605787d5e2075fdd3dd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\cbgcabfifcca.exe
  C:\Users\Admin\AppData\Local\Temp\cbgcabfifcca.exe 7-3-0-4-9-1-6-8-6-8-9 KE1JQDQwLy0zKxcoUFU+R0g+NSoYJkdCVFNGUUVBPjUoGSxERUpTQzw3KigsMTMcJkJDPDcoFyhNUks7VD1MWUE7Ni8wMCowGidNPUlPQlJbTFFGNWJsa2k3LytqZGxuKGxfXiphbGcsXlluWSVia2ZrFy49REM7QkJBPRwmQys1JykXKEEyOSQwGic+KzQmLiArOzM3JSsYJj0yPSkoHylITEc7TkBUW0dRQ047O1A2HS9MSU4+TT1MVj5STD00HylITEc7TkBUW0VARz03QlhvXiArPFc/V09KQzZldHBnOSknZFltWmFsKmp0aCZdZ2QodGVeWG9qaylcZnBrbGtYYyk5b2xmPUk/PmxtXmRfQVs2NjUtKTIaJz9QPFhATUBDSEg9NxgmQUxTUFZBTEdRSzxLOjIcJlNCOUhDUEhSX1FJSzcYKU5ENi8gKztSKzUaJ0lOS1RFRERZTz9EOkhKRUVEQEE9T0pDNh0vRUpeTE1ITEBGQj1waXRfGClKPE1SUkpATUFXT0s8S1xEPVBSNyoaJz9CQUVUNDAaJ0NLVj1WTj1ESD1XP0Y6S1ZQUDxDN15bZGpeHS9ARlZIREk5O1hGUDkuMigqKyYoMTIuLTA2GidOQUQ+OjEwKTMrKS8sMCodL0BGVkhESTk7WFFJSTw8LCcrLiYrLTExITY0KzIyKConUEk=
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704410380.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704410380.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704410380.txt bios get version
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704410380.txt bios get version
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81704410380.txt bios get version
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 372
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81704410380.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81704410380.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81704410380.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit
\Users\Admin\AppData\Local\Temp\cbgcabfifcca.exe

Filesize
1.0MB

MD5
49a51ade1296ee93140e4f23ba1b0934

SHA1
5e37d07b7112554fff936907b2276b5ecfd5bacb

SHA256
269a3ab7ffd27f4a7d2bfd91c6ab329dc40a61a3030df98116684bdab6bc4eb8

SHA512
b2de3d80d61d6ee33e7badf8d37f7a2d8e90437324b7452576eb154221b67f791bd11bb52d13bbc5b1bdab5e6da5e42a61192dc6b68b9b6bc6d271d7781075e9

Download Submit
\Users\Admin\AppData\Local\Temp\nseA075.tmp\koi.dll

Filesize
120KB

MD5
ff3ac96d9d128501b224b26ad4b85486

SHA1
ce85c8ee340921b8660f6ad14b5429b3703b6bf5

SHA256
44b5ee3459781f5ca44873c738ca16b050b4101c49dcf8b0da556775be189963

SHA512
a2ab56bf0de5075817a600bb4cca472e82b8f207f5fbd886bbab3e4a8a58b7ed9acc180bbbd3c5646b9c52189962be468dc30fb48f66ade6aa87d3ec8f61e42f

Download Submit
\Users\Admin\AppData\Local\Temp\nseA075.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit