24187609a8c15372bf33585014ce78a5a84737089b492a88ab2caa19711b3676

Analysis

max time kernel
0s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49b24a9694241fa7467d345fac3fef97.exe
Size

976KB
MD5

49b24a9694241fa7467d345fac3fef97
SHA1

f8419e56d458ac8d8d77ffb354b5ced654e9ef2f
SHA256

24187609a8c15372bf33585014ce78a5a84737089b492a88ab2caa19711b3676
SHA512

8f5bfe96a1bf59f7c878ec5c06047ae6d559d65db28eddc4b0ac7a5b15fc601e7e4a05a3cc9c681d9a4234f750751da359ce4b3bc44de6531900bb87a2b482f7
SSDEEP

12288:MTHN/Um3b7bt5ORv7OfUej1YY+oPfmH7OdIgbB1Nx0WkljfyU0NsA3wPPgMSHaI9:MKm3jWRCD+sdDkpYP3wPwn2arw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1976	f.exe

Loads dropped DLL 1 IoCs

pid	Process
4748	49b24a9694241fa7467d345fac3fef97.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
4444	1976	WerFault.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\ = "CBrowserExternal Class"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version\ = "1.0"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Programmable	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\ = "SmartInstallerLib"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS\ = "0"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0"	f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe\""	f.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3180	wmic.exe
Token: SeSecurityPrivilege	3180	wmic.exe
Token: SeTakeOwnershipPrivilege	3180	wmic.exe
Token: SeLoadDriverPrivilege	3180	wmic.exe
Token: SeSystemProfilePrivilege	3180	wmic.exe
Token: SeSystemtimePrivilege	3180	wmic.exe
Token: SeProfSingleProcessPrivilege	3180	wmic.exe
Token: SeIncBasePriorityPrivilege	3180	wmic.exe
Token: SeCreatePagefilePrivilege	3180	wmic.exe
Token: SeBackupPrivilege	3180	wmic.exe
Token: SeRestorePrivilege	3180	wmic.exe
Token: SeShutdownPrivilege	3180	wmic.exe
Token: SeDebugPrivilege	3180	wmic.exe
Token: SeSystemEnvironmentPrivilege	3180	wmic.exe
Token: SeRemoteShutdownPrivilege	3180	wmic.exe
Token: SeUndockPrivilege	3180	wmic.exe
Token: SeManageVolumePrivilege	3180	wmic.exe
Token: 33	3180	wmic.exe
Token: 34	3180	wmic.exe
Token: 35	3180	wmic.exe
Token: 36	3180	wmic.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1976	4748	49b24a9694241fa7467d345fac3fef97.exe	36
PID 4748 wrote to memory of 1976	4748	49b24a9694241fa7467d345fac3fef97.exe	36
PID 4748 wrote to memory of 1976	4748	49b24a9694241fa7467d345fac3fef97.exe	36
PID 1976 wrote to memory of 3180	1976	f.exe	19
PID 1976 wrote to memory of 3180	1976	f.exe	19
PID 1976 wrote to memory of 3180	1976	f.exe	19

C:\Users\Admin\AppData\Local\Temp\49b24a9694241fa7467d345fac3fef97.exe
"C:\Users\Admin\AppData\Local\Temp\49b24a9694241fa7467d345fac3fef97.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\f.exe
  C:\Users\Admin\AppData\Local\Temp\f.exe /PID=3022 /SUBPID=0 /NETWORKID=0 /DISTID=3509 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=ZjdXVpZD1iNzY2ZmM3Mi04OTE3LTRkMmItODNlNC1mYTNjMzcwOTJjNDc /D1=1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1403367853 /VM=2 /DS1= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1976

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get serialnumber
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1976 -ip 1976
1⤵
PID:4652

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 900
1⤵
- Program crash
PID:4444

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
1⤵
PID:2392

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
1⤵
PID:3440

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f.exe

Filesize
7KB

MD5
4a18ceda6346870c56c260aef8a2b20e

SHA1
16489f5f4051012ec2daa6d26a4fcfe4ebec4bd1

SHA256
ede5ed98d5212c695fa285361381b04378629eb552aadf63037f4aca5d465af7

SHA512
e00aa3b9e3edf579c95e4383026b406f569989fed86bc87cd9c0b89f468840115820c7285a5de7e412ed293b326b36a702c35921686dc5c2dcc461a9ff1b5bf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\f.exe

Filesize
36KB

MD5
436e6a9621338dfcead45fe89b748954

SHA1
f2f65e64838e76ef226218412972d951dede5725

SHA256
a7732137c827d812dba39bde3b0a2e940f708588535a7142c29a6723a6c4a45c

SHA512
e2e0a48b1b994bb17ce52f9441b18d705069e54cda3fb0fd8cfaefb765434c24effff0aa3fb990888837d871e5a7ebd415a02a3baa5bc3595e26e7d481435a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg48A3.tmp\Convert.dll

Filesize
1KB

MD5
497dd0acb50576d39330cb1c1f5c4da5

SHA1
ae5350642fe6e0434fba212a162fef21e35774e4

SHA256
23302f221bef670326893215eeb540746e658e838f3b36fff4d2bfdf182f6827

SHA512
af166307006ae4261326e74c4462325776db36d3e68223ed624989fe365796c418f8bd2b6041d9544e49d09b21cf7462c27c378db7724101d9a94a6fe604e8e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg48A3.tmp\Convert.dll

Filesize
33KB

MD5
01d0906247709e89489993decf197690

SHA1
aad43c1b53e2a1c2b97ff5ee23f47eebfe2728cf

SHA256
c798f6f0c705dc31885c2688f670acee79fa59c19cd07a8df8ee1a155f17ba1e

SHA512
5c963a0910e29cc4072ab16f218c1f36b327f715f7bad803773be0b7195fd2d6affb0d61caa5b0ec1cfe4bb8aec788efa8aa968c4d94d1e19097069d97f06372

Download Submit
C:\Users\Admin\AppData\Local\Temp\obhhelper.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\obhhelper.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\obhhelper.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit