37e7d37868a9d4c17f153822fc7744c3e4e0617f6cae9697c778da18d0d91cd6

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/01/2024, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Malware-gen.1638.31612.exe
Size 1.1MB
Sample240130-ss2flahbd4
SHA256 37e7d37868a9d4c17f153822fc7744c3e4e0617f6cae9697c778da18d0d91cd6
MD5 372894142599e37c16b10e893cc0f0b1
SHA1 02f1ad2ed5836fd78d456df8e5dcaf275b65201c
SHA512 a5bc56f6ece6148e9d0c285db1f57b23f8418893d17d3ece6b6ce0aadc7b0aaa2c87ea053ebe0dfe71d21e98d034f6f3c878fe81e1612c321c04711205e6d8b0
SSDEEP 24576:IDuW4f8EQOL58mV7Th8Kp4nD54E0JNS39Egj7C:IDuW4tV8sy04D5R0JNS39Eg6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2484	Taxes.pif

Loads dropped DLL 5 IoCs

pid	Process
2568	cmd.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	2484	WerFault.exe	39

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2728	tasklist.exe
2420	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2544	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2484	Taxes.pif
2484	Taxes.pif
2484	Taxes.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	tasklist.exe
Token: SeDebugPrivilege	2420	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2484	Taxes.pif
2484	Taxes.pif
2484	Taxes.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2484	Taxes.pif
2484	Taxes.pif
2484	Taxes.pif

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2568	1860	SecuriteInfo.com.Win32.Malware-gen.1638.31612.exe	29
PID 1860 wrote to memory of 2568	1860	SecuriteInfo.com.Win32.Malware-gen.1638.31612.exe	29
PID 1860 wrote to memory of 2568	1860	SecuriteInfo.com.Win32.Malware-gen.1638.31612.exe	29
PID 1860 wrote to memory of 2568	1860	SecuriteInfo.com.Win32.Malware-gen.1638.31612.exe	29
PID 2568 wrote to memory of 2728	2568	cmd.exe	31
PID 2568 wrote to memory of 2728	2568	cmd.exe	31
PID 2568 wrote to memory of 2728	2568	cmd.exe	31
PID 2568 wrote to memory of 2728	2568	cmd.exe	31
PID 2568 wrote to memory of 2684	2568	cmd.exe	32
PID 2568 wrote to memory of 2684	2568	cmd.exe	32
PID 2568 wrote to memory of 2684	2568	cmd.exe	32
PID 2568 wrote to memory of 2684	2568	cmd.exe	32
PID 2568 wrote to memory of 2420	2568	cmd.exe	34
PID 2568 wrote to memory of 2420	2568	cmd.exe	34
PID 2568 wrote to memory of 2420	2568	cmd.exe	34
PID 2568 wrote to memory of 2420	2568	cmd.exe	34
PID 2568 wrote to memory of 2676	2568	cmd.exe	35
PID 2568 wrote to memory of 2676	2568	cmd.exe	35
PID 2568 wrote to memory of 2676	2568	cmd.exe	35
PID 2568 wrote to memory of 2676	2568	cmd.exe	35
PID 2568 wrote to memory of 2492	2568	cmd.exe	36
PID 2568 wrote to memory of 2492	2568	cmd.exe	36
PID 2568 wrote to memory of 2492	2568	cmd.exe	36
PID 2568 wrote to memory of 2492	2568	cmd.exe	36
PID 2568 wrote to memory of 2632	2568	cmd.exe	37
PID 2568 wrote to memory of 2632	2568	cmd.exe	37
PID 2568 wrote to memory of 2632	2568	cmd.exe	37
PID 2568 wrote to memory of 2632	2568	cmd.exe	37
PID 2568 wrote to memory of 2740	2568	cmd.exe	38
PID 2568 wrote to memory of 2740	2568	cmd.exe	38
PID 2568 wrote to memory of 2740	2568	cmd.exe	38
PID 2568 wrote to memory of 2740	2568	cmd.exe	38
PID 2568 wrote to memory of 2484	2568	cmd.exe	39
PID 2568 wrote to memory of 2484	2568	cmd.exe	39
PID 2568 wrote to memory of 2484	2568	cmd.exe	39
PID 2568 wrote to memory of 2484	2568	cmd.exe	39
PID 2568 wrote to memory of 2544	2568	cmd.exe	40
PID 2568 wrote to memory of 2544	2568	cmd.exe	40
PID 2568 wrote to memory of 2544	2568	cmd.exe	40
PID 2568 wrote to memory of 2544	2568	cmd.exe	40
PID 2484 wrote to memory of 1924	2484	Taxes.pif	43
PID 2484 wrote to memory of 1924	2484	Taxes.pif	43
PID 2484 wrote to memory of 1924	2484	Taxes.pif	43
PID 2484 wrote to memory of 1924	2484	Taxes.pif	43

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.1638.31612.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.1638.31612.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k move Bathrooms Bathrooms.bat & Bathrooms.bat & exit
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c mkdir 13896
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Compound + Injection + Emotions + Worm + Participants + Richmond 13896\Taxes.pif
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Declare + Assured + Trap 13896\Q
    3⤵
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13896\Taxes.pif
    13896\Taxes.pif 13896\Q
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 516
      4⤵
      Loads dropped DLL
      Program crash
      PID:1924
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13896\Q
Size 1.1MB
SHA256 7f545fbe57821e51c378db90c106bd5fe96a0700a55cb714fecb7f525f692661
MD5 9c8a27c5dc92e70a73b69064474c7553
SHA1 45e9596bfabe5e95fcf75e67b74ef8f4cc4f63d9
SHA512 982cf45b95e6c4b99c2956351f24a0c02b314e645359d54116869983cc05539e0574c8bef7d25f1de366760c65313db56b6e969442cd60f6111ebf310c12bee8
SSDEEP 12288:02B1QuFjlAYH/zgYcR8xl4G0ELxM/TKb0FQmCghCU75p1OHqJdcH1nS3fbXRMJNw:Y6mKjshDtUyROhXKAQwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Assured

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Assured
Size 413KB
SHA256 feb509566e97e0b401fa0c358410c4e30a2ca737e97ab53ba85aa8b7233039e2
MD5 d1d04d0889c995208bfd51027d6bbfb2
SHA1 116695e74320d7c3529e60e088509637355cfe0b
SHA512 b674c1df053b38a19553de2bd99241b67f92b15189b985192e732fbe327dc953e9ff4553753f2a0ce12f282822a88f5e9e3e314ac74a181c44505739f077a1a7
SSDEEP 6144:MiWF3p1OgcqD1/lcEG/Eu8d0n951kI0Hfh8vH:M75p1OHqJdcH1nS3fC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bathrooms

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bathrooms
Size 12KB
SHA256 6bb1eb00577143d94353505d3faa833a6e11a1b1e7a89665374546b6c4224d18
MD5 1730eaebb468f5eb2eb028febf54ae06
SHA1 c14564238ce3b8d9919a54f7d26a368a3c7bb9f4
SHA512 4456f3a7166465e44cd9cad0849fe5113853666f3a9e09b6be41c21de4f2578a036c59043b318e7c07f0dd18c8cad583571890a90c55ceff622eaaa29aa0246a
SSDEEP 384:xKCxKwdDx9Oic7vJ0m5VyZRkRsRxnsRBcEBzRJtRqRBcEmXRZ1cK:xR4YV/UvJHVyZRkRsRxsRBcEBzRJtRqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Compound

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Compound
Size 115KB
SHA256 d636d9543514ffc8ef80980e52e425a7031383274abc22afca077eab72acff06
MD5 f763b8e9bba9221a1683238d61c7d049
SHA1 4a4bc7cec307dec607fbb935bf4eb94482253032
SHA512 639d6478bc94633fcc5f2fe9a65d176edac4b78091864a7ce9a791712d0b80533b551c9c80d2e6012bc776b6c153621e0ca0eb818d9fde9e4cf7dd3394cc6d38
SSDEEP 3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCc:LQBk7JjX74cNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Declare

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Declare
Size 445KB
SHA256 5b151a88f51c5afd71e1437d61d0b5e4e8354b60570ec7eb57ff115314ac00ad
MD5 2894b437eb1f14bb3dc2d0995dc8238e
SHA1 85e96aca379b58c38de290377b2d37fc18825290
SHA512 63830448ee458f98a3019e3bb5cee79841e3620cb711aa2d93754827c1ec491ecd288cb4fda9fc11deea2f0045ea3b00d070aa8dfe3df4091e2f8f53b691b8ef
SSDEEP 12288:02B1QuFjlAYH/zgYcR8xl4G0ELxM/TKb0FQmCghCP:Y6mKjsh0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Emotions

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Emotions
Size 130KB
SHA256 025bdbd4acd0829141281ad412f7ba59e21d253c19fdece25304a7eaca592ba8
MD5 4dd712f3ac47d2632b1fa470891858c9
SHA1 601890d37abdb2de09b11d285e949d48b8b1732c
SHA512 fc1f8918238cdf8ab855cb9b9b9d7bc26d56a382495156155fa7f49aa882069335f33ac3cd2f066140071d386ee7f1e58eb4e263a15ab7cfc60d3b9110a78bc4
SSDEEP 3072:KysRIO7vHZnBfzHl8Dz5YaZYvlfA6Gfza6iyY5tVGvH7fw:qb5nZ2tZ6lfA6Gfm608Dw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Injection

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Injection
Size 208KB
SHA256 afbebec2c0199e3c01ec1d4174bc25dfac1fbdf453450e1c4acfef292bc18bfe
MD5 41677aa1d64845fbd17c72f7ff1837dd
SHA1 83175030ba83b252c125f7c2f17e34a093520c0e
SHA512 141866dbe73438148f859cedb2583735ed3dba10a3826879d2e2125f937376f99e37fdefcbdc1a3886483b07a929cc9d0a359af12fcb624b38c7cb507347b178
SSDEEP 6144:TlrztgwU0Wyw3mFygyE4mqd12lqlEAehuqN8zwNzlmhPLe:TlvSr0Wyw20K4mqClqlEZuBe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Participants

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Participants
Size 148KB
SHA256 1bd9e4921d3e304cbbdbe7e169c090f023940c3901c3f30076aa805aae46a6f9
MD5 96c01cb0caf4a239b2cdac79372c249b
SHA1 2cb4f4550a58ce6ed27b0fb39985486de34b3e55
SHA512 3873b74aa3d88b328bfa2150f670ae6ab2c4ce1712b6ce54989e4f6ed8da0b3a9b1f8d17573ac494598d50cc935ecb1c1b57ad79f37b5156671e7b0f544ceb8b
SSDEEP 3072:x/fA9vtqmcCVs5A3q5eAg0Fuz08XvBNbIaAtbPe:AFqZvEAOz04pmdVW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Richmond

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Richmond
Size 174KB
SHA256 6c3482c9f62da91208f4f67fe2a41211f8a2a7929bfda4841495d20d29bf1e9c
MD5 7cef207172cbdf6768101f8a2602f787
SHA1 20e50bd7257e773fab11928da0a6500693fbad11
SHA512 42e38ae3e936cadbb6b4d0eb013977bcbe3c80a9a44fd22f49ec1ba593625a4146122941e3b90f3a4c20680eb50d074607086cc1f52a851f4e5ae2eaf0ce44f9
SSDEEP 3072:e6jKj+wsxjgarB3RZgDWy4ZNogXJ3i2Umb2Oq:e64EgarxUaBZ2myoG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trap

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Trap
Size 281KB
SHA256 7b7cf2cd49f10dc905422e24ffdaff2c377396d1ff623ed575e57b0a99f5d289
MD5 d5fd8c3a3d4a968f112f86831ddcf1ac
SHA1 7178a8a80cb629f325d5f7edb1a9eeb27eaf809f
SHA512 e41891e01a6f86db8a7d7e3c57dcc984a43d1ef7adaa2c13c2230f36bc122b8cd12f8a72090c19391337d283dc708f999fbc329a4f06acfc5ca291792e53a97f
SSDEEP 3072:GEBc3Prvd/ELl1xSfsQhCnyPO4lhy13QxubsLu7dRnxIcfhgvVuV1YEjVqXn96IP:GEuzF/ELlX9QQny9hEHYLIZgNGbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Worm

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Worm
Size 149KB
SHA256 baf2429c6f2b7b3c7aa4d6b8402b9f9f518b7a43e134ac6daacc2766bf287d4d
MD5 6afe1e03a71f26058460f4b6c4973d26
SHA1 315f3c5e3087fcdaa883ea3dc0ff463cd9f92f1c
SHA512 6dc51f1379bc042cec6b07e53d60621cb7f81131f99c96e4d9fc782fa118b4fdbcce86ce82e58f620e06b3d7eda4c6f76e104f33d579a51e4cbf490d0afc84fe
SSDEEP 3072:pUQwHJJX4xF5jtHk5B+LNBPcAvPTjFq9iOIXyTw0ltj0EowPOGU6WS2uLhxjRYl:pvqJX4xNAB+xHFq9O0lHPOGUWLhxjRYl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taxes.pif

Path \Users\Admin\AppData\Local\Temp\7ZipSfx.000\13896\Taxes.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Taxes.pif

Path \Users\Admin\AppData\Local\Temp\7ZipSfx.000\13896\Taxes.pif
Size 640KB
SHA256 d72fa8bc87379641139f1fc54bc4e3a350ddbfc98a98e6b57749f54795fe23f8
MD5 216c8668bd25cdf3595e81b6c2066184
SHA1 af6e7c7724d65752d2633c0e226fa4901bf2fa71
SHA512 104be0d26a93ae5943bfad49df77e3710b336896615342840bcbcbb953d424b722bc59e1c3362ca4f36a3e12142888a62dabf97dca8556be1b1b2daa13d1a91e
SSDEEP 12288:LO0z8e0lvSr0Wyw20K4mqClqlEZuB1b5Z2tZ6XKmNvqJWNAB+X0lHPOGNnlMZU:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2484-36-0x0000000000160000-0x0000000000161000-memory.dmp

Download

memory/2484-37-0x0000000004B80000-0x0000000004C0B000-memory.dmp

Download

memory/2484-38-0x0000000004B80000-0x0000000004C0B000-memory.dmp

Download

memory/2484-39-0x0000000004B80000-0x0000000004C0B000-memory.dmp

Download

memory/2484-40-0x0000000004B80000-0x0000000004C0B000-memory.dmp

Download

memory/2484-41-0x0000000004B80000-0x0000000004C0B000-memory.dmp

Download

memory/2484-42-0x0000000004B80000-0x0000000004C0B000-memory.dmp

Download

memory/2484-43-0x0000000000170000-0x0000000000171000-memory.dmp

Download