Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13-01-2024 21:14
Static task
static1
Behavioral task
behavioral1
Sample
596e6a57f98dce2966abc845efe79216.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
596e6a57f98dce2966abc845efe79216.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/hoy.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/hoy.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
596e6a57f98dce2966abc845efe79216.exe
-
Size
582KB
-
MD5
596e6a57f98dce2966abc845efe79216
-
SHA1
70a1a8d5034558d0b436127a6055cd532f7f9036
-
SHA256
12bafbb6f4221ff2a8099f2509f61d9b26bd3287ad3dce4e0305c973265994d4
-
SHA512
3f512a5f9592a2219770334823496ca444cb48bc4361a614abdb644ff6cdd096a09dfee99a2b8c9b8116624a75b3ebf65ba4bb56b6684e8be4e3687c08bb1761
-
SSDEEP
12288:g+reVu3HfnpU4ZxOJhgKZFXX4U9KQj1YSYDjc:g+V64ZOhZZFn4U9KQjQDo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2868 bbdcabfddbbc.exe -
Loads dropped DLL 10 IoCs
pid Process 1888 596e6a57f98dce2966abc845efe79216.exe 1888 596e6a57f98dce2966abc845efe79216.exe 1888 596e6a57f98dce2966abc845efe79216.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2680 2868 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2852 wmic.exe Token: SeSecurityPrivilege 2852 wmic.exe Token: SeTakeOwnershipPrivilege 2852 wmic.exe Token: SeLoadDriverPrivilege 2852 wmic.exe Token: SeSystemProfilePrivilege 2852 wmic.exe Token: SeSystemtimePrivilege 2852 wmic.exe Token: SeProfSingleProcessPrivilege 2852 wmic.exe Token: SeIncBasePriorityPrivilege 2852 wmic.exe Token: SeCreatePagefilePrivilege 2852 wmic.exe Token: SeBackupPrivilege 2852 wmic.exe Token: SeRestorePrivilege 2852 wmic.exe Token: SeShutdownPrivilege 2852 wmic.exe Token: SeDebugPrivilege 2852 wmic.exe Token: SeSystemEnvironmentPrivilege 2852 wmic.exe Token: SeRemoteShutdownPrivilege 2852 wmic.exe Token: SeUndockPrivilege 2852 wmic.exe Token: SeManageVolumePrivilege 2852 wmic.exe Token: 33 2852 wmic.exe Token: 34 2852 wmic.exe Token: 35 2852 wmic.exe Token: SeIncreaseQuotaPrivilege 2852 wmic.exe Token: SeSecurityPrivilege 2852 wmic.exe Token: SeTakeOwnershipPrivilege 2852 wmic.exe Token: SeLoadDriverPrivilege 2852 wmic.exe Token: SeSystemProfilePrivilege 2852 wmic.exe Token: SeSystemtimePrivilege 2852 wmic.exe Token: SeProfSingleProcessPrivilege 2852 wmic.exe Token: SeIncBasePriorityPrivilege 2852 wmic.exe Token: SeCreatePagefilePrivilege 2852 wmic.exe Token: SeBackupPrivilege 2852 wmic.exe Token: SeRestorePrivilege 2852 wmic.exe Token: SeShutdownPrivilege 2852 wmic.exe Token: SeDebugPrivilege 2852 wmic.exe Token: SeSystemEnvironmentPrivilege 2852 wmic.exe Token: SeRemoteShutdownPrivilege 2852 wmic.exe Token: SeUndockPrivilege 2852 wmic.exe Token: SeManageVolumePrivilege 2852 wmic.exe Token: 33 2852 wmic.exe Token: 34 2852 wmic.exe Token: 35 2852 wmic.exe Token: SeIncreaseQuotaPrivilege 2892 wmic.exe Token: SeSecurityPrivilege 2892 wmic.exe Token: SeTakeOwnershipPrivilege 2892 wmic.exe Token: SeLoadDriverPrivilege 2892 wmic.exe Token: SeSystemProfilePrivilege 2892 wmic.exe Token: SeSystemtimePrivilege 2892 wmic.exe Token: SeProfSingleProcessPrivilege 2892 wmic.exe Token: SeIncBasePriorityPrivilege 2892 wmic.exe Token: SeCreatePagefilePrivilege 2892 wmic.exe Token: SeBackupPrivilege 2892 wmic.exe Token: SeRestorePrivilege 2892 wmic.exe Token: SeShutdownPrivilege 2892 wmic.exe Token: SeDebugPrivilege 2892 wmic.exe Token: SeSystemEnvironmentPrivilege 2892 wmic.exe Token: SeRemoteShutdownPrivilege 2892 wmic.exe Token: SeUndockPrivilege 2892 wmic.exe Token: SeManageVolumePrivilege 2892 wmic.exe Token: 33 2892 wmic.exe Token: 34 2892 wmic.exe Token: 35 2892 wmic.exe Token: SeIncreaseQuotaPrivilege 2892 wmic.exe Token: SeSecurityPrivilege 2892 wmic.exe Token: SeTakeOwnershipPrivilege 2892 wmic.exe Token: SeLoadDriverPrivilege 2892 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2868 1888 596e6a57f98dce2966abc845efe79216.exe 28 PID 1888 wrote to memory of 2868 1888 596e6a57f98dce2966abc845efe79216.exe 28 PID 1888 wrote to memory of 2868 1888 596e6a57f98dce2966abc845efe79216.exe 28 PID 1888 wrote to memory of 2868 1888 596e6a57f98dce2966abc845efe79216.exe 28 PID 2868 wrote to memory of 2852 2868 bbdcabfddbbc.exe 29 PID 2868 wrote to memory of 2852 2868 bbdcabfddbbc.exe 29 PID 2868 wrote to memory of 2852 2868 bbdcabfddbbc.exe 29 PID 2868 wrote to memory of 2852 2868 bbdcabfddbbc.exe 29 PID 2868 wrote to memory of 2892 2868 bbdcabfddbbc.exe 32 PID 2868 wrote to memory of 2892 2868 bbdcabfddbbc.exe 32 PID 2868 wrote to memory of 2892 2868 bbdcabfddbbc.exe 32 PID 2868 wrote to memory of 2892 2868 bbdcabfddbbc.exe 32 PID 2868 wrote to memory of 2656 2868 bbdcabfddbbc.exe 34 PID 2868 wrote to memory of 2656 2868 bbdcabfddbbc.exe 34 PID 2868 wrote to memory of 2656 2868 bbdcabfddbbc.exe 34 PID 2868 wrote to memory of 2656 2868 bbdcabfddbbc.exe 34 PID 2868 wrote to memory of 2272 2868 bbdcabfddbbc.exe 36 PID 2868 wrote to memory of 2272 2868 bbdcabfddbbc.exe 36 PID 2868 wrote to memory of 2272 2868 bbdcabfddbbc.exe 36 PID 2868 wrote to memory of 2272 2868 bbdcabfddbbc.exe 36 PID 2868 wrote to memory of 1492 2868 bbdcabfddbbc.exe 38 PID 2868 wrote to memory of 1492 2868 bbdcabfddbbc.exe 38 PID 2868 wrote to memory of 1492 2868 bbdcabfddbbc.exe 38 PID 2868 wrote to memory of 1492 2868 bbdcabfddbbc.exe 38 PID 2868 wrote to memory of 2680 2868 bbdcabfddbbc.exe 40 PID 2868 wrote to memory of 2680 2868 bbdcabfddbbc.exe 40 PID 2868 wrote to memory of 2680 2868 bbdcabfddbbc.exe 40 PID 2868 wrote to memory of 2680 2868 bbdcabfddbbc.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\596e6a57f98dce2966abc845efe79216.exe"C:\Users\Admin\AppData\Local\Temp\596e6a57f98dce2966abc845efe79216.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\bbdcabfddbbc.exeC:\Users\Admin\AppData\Local\Temp\bbdcabfddbbc.exe 6-8-3-3-6-6-5-3-5-8-9 KUhGQTcxLi0tGCZNTT9NQz44LRsnRT9MVExMRURBOCgXKTxGUE5DPzotLCwuKx0sPUM/OisYJkpKTEFPPU9cRDw0Ky42MRopTkJNTjxMV1JPRjdjcW9oMSkncGJscClxY10kW2htKl5bb14pYWVgZx0sPUZEQEZBOzcpNjYqLC0tLisqGidBLjcrMTIuMBcpPC86JysbLD8rNCcpHSw+LjgqLBgmPi06KisaKk1NRztPO1FcSkxEUzw7UDcYLE1MST9SPkxWP01JPjcaKk1NRztPO1FcSDtIQjgYJj9QQlxPTEc6Gyc8Uj1cQEc+R0ZJPTQaJ0VMTU5aP01HTk09TzosGipRQzlFRVFMUllPTUk4GCZQRTovGik/UCw1FylKUktOQ0hCWk88RjtMSj9DSD5CPUxMRDodKUNOXE1NRU5BSkI3bm1yYBgmTD1RUkxIREtCV0xNPU9cPjtUUDgqFylARkE/UjguGydATVdBVkg7SEY+VzxIO09WSk5AQTheWGZrYh0pPkpUSURGOzxcRko3MTQpKSsqJjY2KCwuMRsnS0NFQjorLi0uLC8vKiwyHSk+SlRJREY7PFxRQ0dAOiwnKC0nLy0rLyU0NSwnNCwyJ0pH2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81705180491.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81705180491.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81705180491.txt bios get version3⤵PID:2656
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81705180491.txt bios get version3⤵PID:2272
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81705180491.txt bios get version3⤵PID:1492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:2680
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
826KB
MD53951076afb338c9c553610e9f2c40a57
SHA104004dabc8a3759135dcaa012fc9b42b1fa9c780
SHA2565f2d6d81847e234a5bc4e61db0f9b0e91a88256df0c7aed12e42b6b2fc0d0cbe
SHA512f87796ee8a7b2a6c4f8c86ead655783366ccfc83e05dcb04962bd5e2d24c474cca7a9cd23ede459e6b043f67ac36689b478851d5afcf0c395dde7dbcd04d31a4
-
Filesize
121KB
MD5d00f45379ede6a0e0d14c5ecf92a2fda
SHA16f7ba5ba01e34ffdc2e014b01ef0e37d33a2961a
SHA2561999663109d285edb0c4ef3703536baa6d1d6345b5c163550cee2a194ce78794
SHA5127e3ea142e2f3d727682d8d44b35a85bf2bf0857bcda803b9b3b7fafcc82c76992a5ec3e5f7065f1a3bdef387847a40d0c3122ed0d91314dde0fded654120e7f0
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5