10db97906966767ac56af42d32da193d7e0ae5ec77472de0d038a49f9971d3e7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f2dc83cfd26d8b81ca758639e17bc25.exe
Size

685KB
MD5

7f2dc83cfd26d8b81ca758639e17bc25
SHA1

c314842e542bead50b9edff9e5f55aac509541ad
SHA256

10db97906966767ac56af42d32da193d7e0ae5ec77472de0d038a49f9971d3e7
SHA512

2fccba6c8e93557e42f67aebc66973d7e0ccd7e733f4a9779f4d4cd0e5267f18d7345eff5edd7f7f894a1aba706917174726bdffe6037d3ad38b178a6ef08d90
SSDEEP

12288:C4Z8eONaj+evj1Y3zdVB4Xf5xS0TJ4fg0zhvy5dO4JD6pyqfc8vy4hwu:C4ZI+UnB4Xf5HTkg0VK584B6EH863u

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1628	bedfjegfeb.exe

Loads dropped DLL 11 IoCs

pid	Process
1820	7f2dc83cfd26d8b81ca758639e17bc25.exe
1820	7f2dc83cfd26d8b81ca758639e17bc25.exe
1820	7f2dc83cfd26d8b81ca758639e17bc25.exe
1820	7f2dc83cfd26d8b81ca758639e17bc25.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe
2136	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	1628	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2928	wmic.exe
Token: SeSecurityPrivilege	2928	wmic.exe
Token: SeTakeOwnershipPrivilege	2928	wmic.exe
Token: SeLoadDriverPrivilege	2928	wmic.exe
Token: SeSystemProfilePrivilege	2928	wmic.exe
Token: SeSystemtimePrivilege	2928	wmic.exe
Token: SeProfSingleProcessPrivilege	2928	wmic.exe
Token: SeIncBasePriorityPrivilege	2928	wmic.exe
Token: SeCreatePagefilePrivilege	2928	wmic.exe
Token: SeBackupPrivilege	2928	wmic.exe
Token: SeRestorePrivilege	2928	wmic.exe
Token: SeShutdownPrivilege	2928	wmic.exe
Token: SeDebugPrivilege	2928	wmic.exe
Token: SeSystemEnvironmentPrivilege	2928	wmic.exe
Token: SeRemoteShutdownPrivilege	2928	wmic.exe
Token: SeUndockPrivilege	2928	wmic.exe
Token: SeManageVolumePrivilege	2928	wmic.exe
Token: 33	2928	wmic.exe
Token: 34	2928	wmic.exe
Token: 35	2928	wmic.exe
Token: SeIncreaseQuotaPrivilege	2928	wmic.exe
Token: SeSecurityPrivilege	2928	wmic.exe
Token: SeTakeOwnershipPrivilege	2928	wmic.exe
Token: SeLoadDriverPrivilege	2928	wmic.exe
Token: SeSystemProfilePrivilege	2928	wmic.exe
Token: SeSystemtimePrivilege	2928	wmic.exe
Token: SeProfSingleProcessPrivilege	2928	wmic.exe
Token: SeIncBasePriorityPrivilege	2928	wmic.exe
Token: SeCreatePagefilePrivilege	2928	wmic.exe
Token: SeBackupPrivilege	2928	wmic.exe
Token: SeRestorePrivilege	2928	wmic.exe
Token: SeShutdownPrivilege	2928	wmic.exe
Token: SeDebugPrivilege	2928	wmic.exe
Token: SeSystemEnvironmentPrivilege	2928	wmic.exe
Token: SeRemoteShutdownPrivilege	2928	wmic.exe
Token: SeUndockPrivilege	2928	wmic.exe
Token: SeManageVolumePrivilege	2928	wmic.exe
Token: 33	2928	wmic.exe
Token: 34	2928	wmic.exe
Token: 35	2928	wmic.exe
Token: SeIncreaseQuotaPrivilege	3032	wmic.exe
Token: SeSecurityPrivilege	3032	wmic.exe
Token: SeTakeOwnershipPrivilege	3032	wmic.exe
Token: SeLoadDriverPrivilege	3032	wmic.exe
Token: SeSystemProfilePrivilege	3032	wmic.exe
Token: SeSystemtimePrivilege	3032	wmic.exe
Token: SeProfSingleProcessPrivilege	3032	wmic.exe
Token: SeIncBasePriorityPrivilege	3032	wmic.exe
Token: SeCreatePagefilePrivilege	3032	wmic.exe
Token: SeBackupPrivilege	3032	wmic.exe
Token: SeRestorePrivilege	3032	wmic.exe
Token: SeShutdownPrivilege	3032	wmic.exe
Token: SeDebugPrivilege	3032	wmic.exe
Token: SeSystemEnvironmentPrivilege	3032	wmic.exe
Token: SeRemoteShutdownPrivilege	3032	wmic.exe
Token: SeUndockPrivilege	3032	wmic.exe
Token: SeManageVolumePrivilege	3032	wmic.exe
Token: 33	3032	wmic.exe
Token: 34	3032	wmic.exe
Token: 35	3032	wmic.exe
Token: SeIncreaseQuotaPrivilege	2840	wmic.exe
Token: SeSecurityPrivilege	2840	wmic.exe
Token: SeTakeOwnershipPrivilege	2840	wmic.exe
Token: SeLoadDriverPrivilege	2840	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1628	1820	7f2dc83cfd26d8b81ca758639e17bc25.exe	28
PID 1820 wrote to memory of 1628	1820	7f2dc83cfd26d8b81ca758639e17bc25.exe	28
PID 1820 wrote to memory of 1628	1820	7f2dc83cfd26d8b81ca758639e17bc25.exe	28
PID 1820 wrote to memory of 1628	1820	7f2dc83cfd26d8b81ca758639e17bc25.exe	28
PID 1628 wrote to memory of 2928	1628	bedfjegfeb.exe	29
PID 1628 wrote to memory of 2928	1628	bedfjegfeb.exe	29
PID 1628 wrote to memory of 2928	1628	bedfjegfeb.exe	29
PID 1628 wrote to memory of 2928	1628	bedfjegfeb.exe	29
PID 1628 wrote to memory of 3032	1628	bedfjegfeb.exe	32
PID 1628 wrote to memory of 3032	1628	bedfjegfeb.exe	32
PID 1628 wrote to memory of 3032	1628	bedfjegfeb.exe	32
PID 1628 wrote to memory of 3032	1628	bedfjegfeb.exe	32
PID 1628 wrote to memory of 2840	1628	bedfjegfeb.exe	35
PID 1628 wrote to memory of 2840	1628	bedfjegfeb.exe	35
PID 1628 wrote to memory of 2840	1628	bedfjegfeb.exe	35
PID 1628 wrote to memory of 2840	1628	bedfjegfeb.exe	35
PID 1628 wrote to memory of 2656	1628	bedfjegfeb.exe	37
PID 1628 wrote to memory of 2656	1628	bedfjegfeb.exe	37
PID 1628 wrote to memory of 2656	1628	bedfjegfeb.exe	37
PID 1628 wrote to memory of 2656	1628	bedfjegfeb.exe	37
PID 1628 wrote to memory of 2368	1628	bedfjegfeb.exe	39
PID 1628 wrote to memory of 2368	1628	bedfjegfeb.exe	39
PID 1628 wrote to memory of 2368	1628	bedfjegfeb.exe	39
PID 1628 wrote to memory of 2368	1628	bedfjegfeb.exe	39
PID 1628 wrote to memory of 2136	1628	bedfjegfeb.exe	40
PID 1628 wrote to memory of 2136	1628	bedfjegfeb.exe	40
PID 1628 wrote to memory of 2136	1628	bedfjegfeb.exe	40
PID 1628 wrote to memory of 2136	1628	bedfjegfeb.exe	40

C:\Users\Admin\AppData\Local\Temp\7f2dc83cfd26d8b81ca758639e17bc25.exe
"C:\Users\Admin\AppData\Local\Temp\7f2dc83cfd26d8b81ca758639e17bc25.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\bedfjegfeb.exe
  C:\Users\Admin\AppData\Local\Temp\bedfjegfeb.exe 7]3]9]5]1]5]9]6]2]8]4 KE1APzwxKjIeJ09OP0dEQzgnGi1GQU1URk1KRDs3LxgrPUZKT0g/NC8yLBwoQEA/PCsXKU5KSz1SOk9eRDs3Mi4tGSxKQFFRPExdTU5FOl9vc2sxKS1rbm8rO0BSRiROTUgpOk1HKUhJPUkeJz9FRjpGSD80Gi08LTYxJzAyMC0wHidAKzosMS8bJj4xNSkqHSY/MzgkKx4nQC46JCwfKkdMTTxRPFFWS1FETTtBUTkZLEdNTj9MPVJXQU5JODgfKkdMTTxRPFFWSUBIPDc/W25oa2BuJC0nTnBtYR4vJ0RsXF5fIyosKy0oLyQtJ0pwXWlichcqRFM8WVNKSDYdJkBXQFY9SzxIQks8OB8qP0lRTFs7T0ZSUkBJNzMYK01FOElKVEZPXU1ORToXKlVINCweJ0BMLjQbLk1MSFJBST5cTkBLPkZHQ0FJOkQ8UFFHNBotQU9YT0xJU0REPztsbm5iFypRQEtPUEZFR0RWUFJASVlCOVVMOikbLkNAPkNQOSodJkRSWjtTTDlJQkBWQE0+SVNOTEE9Ol1ca25cGi08S1BLQ0pAP1ZDTjU1KisoLDMpKCsyJi8pHSZLQE04Rko9SFhGRU5TPENGO15dZXBcGy5PQEdDNS0tMCw0NDQnMjIYKz1MTklLSjg+XUxFRkI0Mi4uJiwuKTEjNjEuMDUpLihISQ==
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81706511239.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81706511239.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81706511239.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81706511239.txt bios get version
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81706511239.txt bios get version
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 368
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81706511239.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\bedfjegfeb.exe

Filesize
906KB

MD5
cb9c01449e93b2e089232e5c68e4754d

SHA1
a8db8438428a8502e9d9bf8c0c339dfc0d7046c9

SHA256
d00dbc423061255ad851938e7a849433a5dab756767679caff8bd0afe7a0b80f

SHA512
6aae0d4bc2209f00bd5d2b8d8778ab4383985ffca6a9d8f8ab520b22a248f1e71f7af3e2df0fcbbf8c01e246fe9d0bfa95eb00685b29d8b8e34284106b9f71c1

Download Submit
\Users\Admin\AppData\Local\Temp\nsy5EB.tmp\ZipDLL.dll

Filesize
163KB

MD5
2dc35ddcabcb2b24919b9afae4ec3091

SHA1
9eeed33c3abc656353a7ebd1c66af38cccadd939

SHA256
6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

SHA512
0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

Download Submit
\Users\Admin\AppData\Local\Temp\nsy5EB.tmp\psyzabw.dll

Filesize
161KB

MD5
d9f4f90f9626af7f7356d54e4c03b576

SHA1
983cb93b2cba3c798d4daf62eafb7b7a0c91f176

SHA256
04773d4f03215c9557794207fc0640a4fc321c341cf417032028e8b96388ec32

SHA512
1b0d1db28add8ce5676668398b0183508ddda3551c462fd61de24b19f65cbac531a85bc2acb8f771a513ecd376ff1fa8d2669334a74644a1a8265435dccb977e

Download Submit