Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 08:24
Static task
static1
Behavioral task
behavioral1
Sample
a1673ce11369e685bd9b1fa3dd7a8153.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a1673ce11369e685bd9b1fa3dd7a8153.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/rtm.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/rtm.dll
Resource
win10v2004-20240221-en
General
-
Target
a1673ce11369e685bd9b1fa3dd7a8153.exe
-
Size
600KB
-
MD5
a1673ce11369e685bd9b1fa3dd7a8153
-
SHA1
34bd4ccc809222345246db9f611f474f382e1b32
-
SHA256
2335af0f1f32c4457296f40e539330a294e8b21460cdb8755e715a0fec6be859
-
SHA512
a1e6164e7777bf7e7c169276b99d43409830bd07910b4e2866a029e844e9d8174769fa343ee335b22f8b61af6f4542188cb9077f7bdecb2240212e19215a19b6
-
SSDEEP
12288:neHuihjaB44ZoATF87V4swu1JLb+MI7gK2YW7gPlXT:neOhu4/F8BTwu1JLbFTK2U
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 452 ccecabffhbd.exe -
Loads dropped DLL 2 IoCs
pid Process 1148 a1673ce11369e685bd9b1fa3dd7a8153.exe 1148 a1673ce11369e685bd9b1fa3dd7a8153.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3912 452 WerFault.exe 87 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1944 wmic.exe Token: SeSecurityPrivilege 1944 wmic.exe Token: SeTakeOwnershipPrivilege 1944 wmic.exe Token: SeLoadDriverPrivilege 1944 wmic.exe Token: SeSystemProfilePrivilege 1944 wmic.exe Token: SeSystemtimePrivilege 1944 wmic.exe Token: SeProfSingleProcessPrivilege 1944 wmic.exe Token: SeIncBasePriorityPrivilege 1944 wmic.exe Token: SeCreatePagefilePrivilege 1944 wmic.exe Token: SeBackupPrivilege 1944 wmic.exe Token: SeRestorePrivilege 1944 wmic.exe Token: SeShutdownPrivilege 1944 wmic.exe Token: SeDebugPrivilege 1944 wmic.exe Token: SeSystemEnvironmentPrivilege 1944 wmic.exe Token: SeRemoteShutdownPrivilege 1944 wmic.exe Token: SeUndockPrivilege 1944 wmic.exe Token: SeManageVolumePrivilege 1944 wmic.exe Token: 33 1944 wmic.exe Token: 34 1944 wmic.exe Token: 35 1944 wmic.exe Token: 36 1944 wmic.exe Token: SeIncreaseQuotaPrivilege 1944 wmic.exe Token: SeSecurityPrivilege 1944 wmic.exe Token: SeTakeOwnershipPrivilege 1944 wmic.exe Token: SeLoadDriverPrivilege 1944 wmic.exe Token: SeSystemProfilePrivilege 1944 wmic.exe Token: SeSystemtimePrivilege 1944 wmic.exe Token: SeProfSingleProcessPrivilege 1944 wmic.exe Token: SeIncBasePriorityPrivilege 1944 wmic.exe Token: SeCreatePagefilePrivilege 1944 wmic.exe Token: SeBackupPrivilege 1944 wmic.exe Token: SeRestorePrivilege 1944 wmic.exe Token: SeShutdownPrivilege 1944 wmic.exe Token: SeDebugPrivilege 1944 wmic.exe Token: SeSystemEnvironmentPrivilege 1944 wmic.exe Token: SeRemoteShutdownPrivilege 1944 wmic.exe Token: SeUndockPrivilege 1944 wmic.exe Token: SeManageVolumePrivilege 1944 wmic.exe Token: 33 1944 wmic.exe Token: 34 1944 wmic.exe Token: 35 1944 wmic.exe Token: 36 1944 wmic.exe Token: SeIncreaseQuotaPrivilege 3480 wmic.exe Token: SeSecurityPrivilege 3480 wmic.exe Token: SeTakeOwnershipPrivilege 3480 wmic.exe Token: SeLoadDriverPrivilege 3480 wmic.exe Token: SeSystemProfilePrivilege 3480 wmic.exe Token: SeSystemtimePrivilege 3480 wmic.exe Token: SeProfSingleProcessPrivilege 3480 wmic.exe Token: SeIncBasePriorityPrivilege 3480 wmic.exe Token: SeCreatePagefilePrivilege 3480 wmic.exe Token: SeBackupPrivilege 3480 wmic.exe Token: SeRestorePrivilege 3480 wmic.exe Token: SeShutdownPrivilege 3480 wmic.exe Token: SeDebugPrivilege 3480 wmic.exe Token: SeSystemEnvironmentPrivilege 3480 wmic.exe Token: SeRemoteShutdownPrivilege 3480 wmic.exe Token: SeUndockPrivilege 3480 wmic.exe Token: SeManageVolumePrivilege 3480 wmic.exe Token: 33 3480 wmic.exe Token: 34 3480 wmic.exe Token: 35 3480 wmic.exe Token: 36 3480 wmic.exe Token: SeIncreaseQuotaPrivilege 3480 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1148 wrote to memory of 452 1148 a1673ce11369e685bd9b1fa3dd7a8153.exe 87 PID 1148 wrote to memory of 452 1148 a1673ce11369e685bd9b1fa3dd7a8153.exe 87 PID 1148 wrote to memory of 452 1148 a1673ce11369e685bd9b1fa3dd7a8153.exe 87 PID 452 wrote to memory of 1944 452 ccecabffhbd.exe 89 PID 452 wrote to memory of 1944 452 ccecabffhbd.exe 89 PID 452 wrote to memory of 1944 452 ccecabffhbd.exe 89 PID 452 wrote to memory of 3480 452 ccecabffhbd.exe 92 PID 452 wrote to memory of 3480 452 ccecabffhbd.exe 92 PID 452 wrote to memory of 3480 452 ccecabffhbd.exe 92 PID 452 wrote to memory of 4064 452 ccecabffhbd.exe 94 PID 452 wrote to memory of 4064 452 ccecabffhbd.exe 94 PID 452 wrote to memory of 4064 452 ccecabffhbd.exe 94 PID 452 wrote to memory of 2104 452 ccecabffhbd.exe 96 PID 452 wrote to memory of 2104 452 ccecabffhbd.exe 96 PID 452 wrote to memory of 2104 452 ccecabffhbd.exe 96 PID 452 wrote to memory of 1704 452 ccecabffhbd.exe 98 PID 452 wrote to memory of 1704 452 ccecabffhbd.exe 98 PID 452 wrote to memory of 1704 452 ccecabffhbd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1673ce11369e685bd9b1fa3dd7a8153.exe"C:\Users\Admin\AppData\Local\Temp\a1673ce11369e685bd9b1fa3dd7a8153.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\ccecabffhbd.exeC:\Users\Admin\AppData\Local\Temp\ccecabffhbd.exe 7-6-4-8-9-2-7-9-8-4-4 KEpFPDQwKy0uHCtMTz5IQEI2JxgrSj5OU0dJSUI7NS0cKD5FS0tHPTQqLywxKxwnOkc9NCgcK0lMSzxMQU1WQUA5KywuLyweKEo9TlI+TFtNSUo2X2xwbDMpK2tccG8lbGRhJltsaCRiWmtZKmVnYGsYJkFFQDtHRT03HCc7LzYkKRwrPSw5JSgeKDsrOSkqGis8KzsmKBgrQC43KSkXLUlJR0BRPE5bSElHTzg7VTkZKUxKRkJOOkxbQU5GPTUXLUlJR0BRPE5bRjhLPjQYK0FRP1tNSUo2FydBVD5ZP0U7SkJFPTkcKEJLS0tdO0lHU08+TDkpFy1NPzlKR1JJUVdMUEU0GCtSRjcuGCZCTCg1HCtLT0pMQEs+Vk9BSDxJST1ASzo+PVFORTccJ0BRWElNSlBCR0E1a3BuXBgrTj5OUUpFR0c+V1FPPkxbPDhXTDQqHCtBQ0A9TzsqFydFT1g+VUY4S0I6V0FKPExVSEtDPTReXWhsXxwnO01QRURLPT1ZRUg0LzIpJjQtJyssLSUwLioYK1BCR0E1KDIrKy81LjIzMhgmQkhORkhLOj5bTEBLPjQqKy4tKS4oKDMjKjIwNTMvMiJHSw==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81708763088.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81708763088.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81708763088.txt bios get version3⤵PID:4064
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81708763088.txt bios get version3⤵PID:2104
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81708763088.txt bios get version3⤵PID:1704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 9563⤵
- Program crash
PID:3912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 452 -ip 4521⤵PID:556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
Filesize
768KB
MD5a496c00622f8f51a1e9d51328dbf281e
SHA1a176ae4f204d815590923a87b1795fcb96caf0eb
SHA256ce7f278246b65532be85f8dff7ae3506eb880a82870d40ce864dd28cd9f8edc2
SHA5126b6023ce11c30272ba0ad58c076911649b1c25fc902741995c9647467a33100f9dc3b621e8eafa27383f33365159378685b78cbd6e238f8e7d367bfc64f0e10a
-
Filesize
640KB
MD51f42b60af346c9b2499f136bbcedb413
SHA1587e652d82c9ccb1a3bd18e0ab9f1f82c220f6fa
SHA256e45d70a6988bb50986d7477821a17be27466e683aae07c6251d6de46aba2b21e
SHA512ff0fce9dd3b7f35227586cc650fc3ce6b677d18dc262edb25997df8cc47bd64adac68aed947ed1b32007fc6169448a50adcfb0f938be2554e80591dec81268e3
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
-
Filesize
125KB
MD5dcf5bed7cdb5677ce2eb2b53e3baf344
SHA1af8e22a2a976bd33892a5fb73548b1e5a2ae63fe
SHA256ae175ba3963a7c8d65f252266de0058630c9c7395b6e2f3b6b817a5285b8f544
SHA51230ca7aa4b7f43deafbde4c90682d9eb611551b5c26a77d92427e8d17b307842914ef0cc1f1ed50809d34d2e8408a5dae4527406dd40dbd1a323c8bed492261fd