Analysis
- max time kernel
91s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
01/02/2024, 09:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8680e0d4b2bab866f20e5fca214f7a13.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
8680e0d4b2bab866f20e5fca214f7a13.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/anlfxoa.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/anlfxoa.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 8680e0d4b2bab866f20e5fca214f7a13.exe
- Size 695KB
- Sample240201-k7f47saghl
- SHA256 20749568fffbc67bbc3c158c1b9f03b2a312f041eef298505e40a52916a755f7
- MD5 8680e0d4b2bab866f20e5fca214f7a13
- SHA1 99f4a829b86b9f8858e0893f1fcf16ec81e33d52
- SHA512 60fe325788bbab2b04d7581695a9ca172a3899bdc8078ae9ed1db6e1293233f93f6a8533960a2c0b8648df006fee4fcf533c14b83caab15cbb67531c563c3fa1
- SSDEEP 12288:QypbtXr+Y6Q8Qy2Xw9xVtKmRqfXn3XpcGimtzTr3B6qwYaUy43Ie5JE:QyzXrB6VQbg9TtKmRqfX3aGjNcYaUVM
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4328 1432252882.exe - Loads dropped DLL 2 IoCs
pid Process 3344 8680e0d4b2bab866f20e5fca214f7a13.exe 3344 8680e0d4b2bab866f20e5fca214f7a13.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 3772 4328 WerFault.exe 33 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2204 wmic.exe Token: SeSecurityPrivilege 2204 wmic.exe Token: SeTakeOwnershipPrivilege 2204 wmic.exe Token: SeLoadDriverPrivilege 2204 wmic.exe Token: SeSystemProfilePrivilege 2204 wmic.exe Token: SeSystemtimePrivilege 2204 wmic.exe Token: SeProfSingleProcessPrivilege 2204 wmic.exe Token: SeIncBasePriorityPrivilege 2204 wmic.exe Token: SeCreatePagefilePrivilege 2204 wmic.exe Token: SeBackupPrivilege 2204 wmic.exe Token: SeRestorePrivilege 2204 wmic.exe Token: SeShutdownPrivilege 2204 wmic.exe Token: SeDebugPrivilege 2204 wmic.exe Token: SeSystemEnvironmentPrivilege 2204 wmic.exe Token: SeRemoteShutdownPrivilege 2204 wmic.exe Token: SeUndockPrivilege 2204 wmic.exe Token: SeManageVolumePrivilege 2204 wmic.exe Token: 33 2204 wmic.exe Token: 34 2204 wmic.exe Token: 35 2204 wmic.exe Token: 36 2204 wmic.exe Token: SeIncreaseQuotaPrivilege 2204 wmic.exe Token: SeSecurityPrivilege 2204 wmic.exe Token: SeTakeOwnershipPrivilege 2204 wmic.exe Token: SeLoadDriverPrivilege 2204 wmic.exe Token: SeSystemProfilePrivilege 2204 wmic.exe Token: SeSystemtimePrivilege 2204 wmic.exe Token: SeProfSingleProcessPrivilege 2204 wmic.exe Token: SeIncBasePriorityPrivilege 2204 wmic.exe Token: SeCreatePagefilePrivilege 2204 wmic.exe Token: SeBackupPrivilege 2204 wmic.exe Token: SeRestorePrivilege 2204 wmic.exe Token: SeShutdownPrivilege 2204 wmic.exe Token: SeDebugPrivilege 2204 wmic.exe Token: SeSystemEnvironmentPrivilege 2204 wmic.exe Token: SeRemoteShutdownPrivilege 2204 wmic.exe Token: SeUndockPrivilege 2204 wmic.exe Token: SeManageVolumePrivilege 2204 wmic.exe Token: 33 2204 wmic.exe Token: 34 2204 wmic.exe Token: 35 2204 wmic.exe Token: 36 2204 wmic.exe Token: SeIncreaseQuotaPrivilege 2772 wmic.exe Token: SeSecurityPrivilege 2772 wmic.exe Token: SeTakeOwnershipPrivilege 2772 wmic.exe Token: SeLoadDriverPrivilege 2772 wmic.exe Token: SeSystemProfilePrivilege 2772 wmic.exe Token: SeSystemtimePrivilege 2772 wmic.exe Token: SeProfSingleProcessPrivilege 2772 wmic.exe Token: SeIncBasePriorityPrivilege 2772 wmic.exe Token: SeCreatePagefilePrivilege 2772 wmic.exe Token: SeBackupPrivilege 2772 wmic.exe Token: SeRestorePrivilege 2772 wmic.exe Token: SeShutdownPrivilege 2772 wmic.exe Token: SeDebugPrivilege 2772 wmic.exe Token: SeSystemEnvironmentPrivilege 2772 wmic.exe Token: SeRemoteShutdownPrivilege 2772 wmic.exe Token: SeUndockPrivilege 2772 wmic.exe Token: SeManageVolumePrivilege 2772 wmic.exe Token: 33 2772 wmic.exe Token: 34 2772 wmic.exe Token: 35 2772 wmic.exe Token: 36 2772 wmic.exe Token: SeIncreaseQuotaPrivilege 2772 wmic.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3344 wrote to memory of 4328 3344 8680e0d4b2bab866f20e5fca214f7a13.exe 33 PID 3344 wrote to memory of 4328 3344 8680e0d4b2bab866f20e5fca214f7a13.exe 33 PID 3344 wrote to memory of 4328 3344 8680e0d4b2bab866f20e5fca214f7a13.exe 33 PID 4328 wrote to memory of 2204 4328 1432252882.exe 37 PID 4328 wrote to memory of 2204 4328 1432252882.exe 37 PID 4328 wrote to memory of 2204 4328 1432252882.exe 37 PID 4328 wrote to memory of 2772 4328 1432252882.exe 44 PID 4328 wrote to memory of 2772 4328 1432252882.exe 44 PID 4328 wrote to memory of 2772 4328 1432252882.exe 44 PID 4328 wrote to memory of 5036 4328 1432252882.exe 54 PID 4328 wrote to memory of 5036 4328 1432252882.exe 54 PID 4328 wrote to memory of 5036 4328 1432252882.exe 54 PID 4328 wrote to memory of 3208 4328 1432252882.exe 49 PID 4328 wrote to memory of 3208 4328 1432252882.exe 49 PID 4328 wrote to memory of 3208 4328 1432252882.exe 49 PID 4328 wrote to memory of 1280 4328 1432252882.exe 50 PID 4328 wrote to memory of 1280 4328 1432252882.exe 50 PID 4328 wrote to memory of 1280 4328 1432252882.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\8680e0d4b2bab866f20e5fca214f7a13.exe"C:\Users\Admin\AppData\Local\Temp\8680e0d4b2bab866f20e5fca214f7a13.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\1432252882.exeC:\Users\Admin\AppData\Local\Temp\1432252882.exe 1]3]9]1]0]0]6]5]1]5]1 Lk1AQz0zKi0xGy5SUjlPSUQ3Kx8qTURRTk5SS0M/PCsfLkFAUlRJPjgxLzUvLhcuQ0k+OC8bLk9PRkNVQ05aSD88MDMwMyAvTUBRUURRXExRTD1ib3NrOS4sanF2Lj5AUkYsU0xHLEFQSilISUVOHSZCTEk9Rkg/PHYxRC9UOUtFUEhAMUkrSklHSkJBRVJIQBcuRDE3LjIyNTMuFy5EMjcoMBsuQzA0LDEgKT8zOCwwHSZDNT0nLB8qT1FMO1RDVFlLUURVQEBQPCAvSk1OP1RCUVZEVUw7OB8qT1FMO1RDVFlJQEhEPB0mRFhFWVBRRzwfLDxXRV89SENHSE1CNB8vSElOU1pBUUxOUkVSNy4fKlNHPkVKWU9PWlRNSzwdJlVNPSwbLj9SMDoXLlJVSE9ISEReVDxLQ09HQEhIQEZCTFFMPRoqSE5eUVJFU0lNPzhzbXRkHSZRRVRPTU1ETUZcTFJFUlk/QFRSPC8XLkhJPkBXODAfLEBSX0RTSUBISEJcPE1DUlNLU0BDPGNYa3NlGipDSlZNSUZARF9DSzwvNS0vLDAuOC4pODAfLlFATEU9Ky8yLTE1Li83NiApP05STUtMOENfVENIRDg0Li8pLjIwKzApLTkyLjExNio7SB8qVEA6Rm9lclsgMWE4LTUnKihXY2ljanZyKEVTKzYoLCgmT3FianNvJSxhMSkwMSsqNzgrUGBxbmhuaxwxZjEsKTAxHy5SSUs9aG5vbyAyYCIpZSUyYGJkbzAtLSgwMWRfbmhibS1mZWVvJSxhUXBtU2ZkZERvcWlramBjSlhtYWdfbV5fZG9pZnglMmAsMy4xMTMoNzkyHy1lX252a2NuYWRnXG1cZmRvHDFmMS4uMS01MDUwMSUzYDI1MTczMy82MTgtVEU0dEpRSDRhRFN0Sj43cUY9MzFMYy90RlNAYlhTWXJHP0RySEZWKUt4NWJGaV5zSndEdkxDaWdXPjcxR3ByZVk9KzBFaUBiUFIwM0R0amRXaC0pS0NrZFMxSWxXVGdhWlYuM2AtSXNfKW5lWCxVZ1NGb2VQU1p4RmZUblNpQ0JSVWxFSmhzRktCW0NQMGZCTmZjTE5xL2VaUCxtVXl2bQ==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81706778869.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81706778869.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81706778869.txt bios get version3⤵PID:3208
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81706778869.txt bios get version3⤵PID:1280
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81706778869.txt bios get version3⤵PID:5036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 10003⤵
- Program crash
PID:3772
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4328 -ip 43281⤵PID:4460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\1432252882.exe
- Size 57KB
- SHA256 b21e92175028040078690b25693e279c70d706cba88c8c49e7585a39b8852533
- MD5 81bcfb89baa47771f2cc6dd7b95a7554
- SHA1 a7e6421f5c6dc2d07257e3afdc46ed9ccb556a47
- SHA512 2886aedabc8cbc181b396a4e58add009de8e12ef25e766e7b526703cf6d63021657c59b4688e1c3d335ede1e37a2d651ea36a682b9e67cdd726872d14989fd2b
- SSDEEP 1536:Cw/A1k9C4az/9K13ZhKShRwGtBoKopzgjbJR:Cwuk9CJ/9K1JhKS7wGt9oI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1432252882.exe
- Size 1021KB
- SHA256 565263bb324cabd6646c17daca1eeb49341101072edad3105e3561f6e7ac26ad
- MD5 efd8d4aa626ea2438c7f1d45ea488963
- SHA1 51ba4644b07ca68515ba91e93c67b6f8db704895
- SHA512 e9d121eff0185d4277e1c0c8153a4e8b896b802f3c5fa84a2e3d9fa1ad62ba635d6a58d2dd5d25abb9aa747bc9f7b6fe7ba69037bebd64a5f8cfcb4646f74a1a
- SSDEEP 24576:vTpuaZQHaGYWtR0DhOW/sMNqu9LFcfVMyLzeA6UHwMY:vtux2OqOfEqu9LFaMyLzeAfHwMY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\81706778869.txt
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\81706778869.txt
- Size 58B
- SHA256 5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
- MD5 dd876faf0fd44a5fab3e82368e2e8b15
- SHA1 01b04083fa278dda3a81705ca5abcfee487a3c90
- SHA512 e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\81706778869.txt
- Size 66B
- SHA256 d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
- MD5 9025468f85256136f923096b01375964
- SHA1 7fcd174999661594fa5f88890ffb195e9858cc52
- SHA512 92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsv5516.tmp\anlfxoa.dll
- Size 158KB
- SHA256 1b5eb8e1e4f95a32a14328b623fa286b474274d59ebcb3947835b26064c757e7
- MD5 d0f94ea3f68bfc8ce4fd3e8556fc0f78
- SHA1 801e60468aa4af2588a9446be448f9563b1af554
- SHA512 6a888ad4ec20e377e891820d40a30be40333ad2547f5b7078b8ab1d56bb5fd0d7811e5dfc417b7d46d0f7fef0ca3266870ae05c44cac28bf9a9efd11e108ffb5
- SSDEEP 3072:T1+E8MAFGzHrozhuuA0QpsN+JuUbI5tlpUj9:T15KAHf0QEimyj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsv5516.tmp\anlfxoa.dll
- Size 143KB
- SHA256 a7b12a5bc6810398f466ae9e7b04feea284f68da94ecc35f8681c5552bfdf4fd
- MD5 018328c9c48ca8777ad0bdd6a6af2462
- SHA1 bbd12a81fe5f79f4caa3124e9dbd453c96f3ab4f
- SHA512 3ae8de516e591fb30975b2d1fa112ea80e1201274245bb1d1975a616868b2f86f2746e64a5a9af7d51293e49c1fc3ec810070e1651e309fb07020fd9f2ef54cb
- SSDEEP 1536:96GrhOMXGrod7aEH/pfao9su0EqgW32QbSHrAKiv7zfJfWuEp0OL2WCBAsHt+Oci:T1+E8MAFGzHrozhuuA0QpsN+JuUbI5t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsv5516.tmp\nsisunz.dll
- Size 40KB
- SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
- MD5 5f13dbc378792f23e598079fc1e4422b
- SHA1 5813c05802f15930aa860b8363af2b58426c8adf
- SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
- SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
- MD5 SHA1 SHA512 SSDEEP