Analysis

  • max time kernel
    1562s
  • max time network
    1566s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-02-2024 11:41

General

  • Target

    LaunchBFH.exe

  • Size

    927KB

  • MD5

    d3c1c1a07fc43292e7e29e57c752d4c5

  • SHA1

    378c2bf9ece8f5db60f56fda569d24c413d64b55

  • SHA256

    80441fcf20760b653d36c4bc78c58c9e05b190e811767c7ed523a904e53b0684

  • SHA512

    d16e8e1da988314de0a130d67fe9f8eacd4c49084ed8e122ad11b2a8e0401fc1e1d1bd48f1cacd9742a447719390d93b5c1d32ef366502553a162740f3978adb

  • SSDEEP

    12288:SdPEXbCuPYDfFyTxAgY1jggLXKHeH82f3Mp6ot7amxgtxBR3Z2txznbQb0YNDSry:SlEXbCjFjgYlyFW3Mam6txBe91fPQ+Te

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LaunchBFH.exe
    "C:\Users\Admin\AppData\Local\Temp\LaunchBFH.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Inventory Inventory.bat & Inventory.bat & exit
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2016
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        3⤵
          PID:3008
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2568
        • C:\Windows\SysWOW64\findstr.exe
          findstr /I "wrsa.exe opssvc.exe"
          3⤵
            PID:2560
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c md 31680
            3⤵
              PID:2604
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c copy /b Cookbook + Increasingly + Rounds + Affordable 31680\Apply.pif
              3⤵
                PID:2572
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b Ink 31680\o
                3⤵
                  PID:2804
                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\31680\Apply.pif
                  31680\Apply.pif 31680\o
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2512
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 524
                    4⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:1944
                • C:\Windows\SysWOW64\PING.EXE
                  ping -n 5 127.0.0.1
                  3⤵
                  • Runs ping.exe
                  PID:2584

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Affordable

              Filesize

              142KB

              MD5

              e66c8890c2eb6adba5948d082bd215a6

              SHA1

              93a813794b38b728c8a6248c64221a419b026ce4

              SHA256

              99e62c44a3dbf370201324564c94be16ffb81b29c543ec5fd6f14e1a3be75e1a

              SHA512

              9b7546cee1ba82ff4db0a3598098be91bbd114e4a80116b15ac9ea106fa881b201eee6dda4ee91b2d917ecaab5bc2327dcd34047c60f122f6e0fdacb79e49d17

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cookbook

              Filesize

              213KB

              MD5

              e9db611974409fb7c1770fe95bfd5402

              SHA1

              ad077d6f8ad48bd4a8edbca88711cc4b7c71c1b5

              SHA256

              fc141ffe6bf256b8794c769feed25fa8bfeff01a60cdd2699e2d84e94585553c

              SHA512

              623694fdcc7acd66ed8170a158d2209706311566e04629c5a03b133902f729a554c3aaa6c85ef1163edaa3dfafd72d85b49f6edfa73e5419e57fac1d2f489799

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Increasingly

              Filesize

              289KB

              MD5

              863ce19b37f186c47a26882e399b9a81

              SHA1

              3843eded5fdd895e41694174d79789854bccada5

              SHA256

              0dbcc3e2ccfd18644f4ec3a24058cf6109e520b0c2213d8a083b5200696d20c6

              SHA512

              ca5323396012958b0269f4f0c1af62c0b26f593d061d81755060873dc270aa8680d4f61b00a445fc123d406d6f0e06fc1f7d45bc54c1efdc757b7e3531199f33

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ink

              Filesize

              701KB

              MD5

              baa1587c7effd1d982a3cfe987d0f4a2

              SHA1

              edf879652a193ac9f685a44fc8ff39da7571f803

              SHA256

              e4160779100599c8404fd1153f0af398df82c8a78ce0ae98e53fdcefdfcad60f

              SHA512

              68d8fdd4877ac7d97a238ad9fe2f91160bf71ea54cbb62bebe56dbfb00dcfe88d6291b9188ff6500caff28bd3b4518f4697e30227279f6059324e6756a995ea4

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Inventory

              Filesize

              12KB

              MD5

              b649c8b485f6b192061ad04a185f03dc

              SHA1

              6fb0cc214d6d55d400793c3d085d9ea98c7fbb87

              SHA256

              fee25a6fcbd1d1bfbeca85e9a97e882d1b4a0bc5a521838f8b6ee1fe6c7370e9

              SHA512

              e12fdc7e64f6b2ad9ef45b01ec7ab87bb1dba4c29e727517b9690018b2ec699bdd2173cf9eac8a0f3441c32ba8a952ab8de2b0bf63c6c47c94f56ba92bf2cbe3

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Rounds

              Filesize

              280KB

              MD5

              12073c3269a07bf6bc9cd8b66462fc0f

              SHA1

              f3a762ef9933b82aeae112b09a231f140ed2363f

              SHA256

              12221e02174a5148dd215e1b1dcc81e47704be82e8dbc4e93eb9a664e582cbda

              SHA512

              e0c586ebb4b18a45345e293189ff52e83d974f52a76c0cd614ac28c6d50288e84f78fc28adeeb0d10adf3bae0a21789e59698e86a96012c2901a32406aceb206

            • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\31680\Apply.pif

              Filesize

              924KB

              MD5

              848164d084384c49937f99d5b894253e

              SHA1

              3055ef803eeec4f175ebf120f94125717ee12444

              SHA256

              f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

              SHA512

              aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

            • memory/2512-25-0x0000000077D40000-0x0000000077E16000-memory.dmp

              Filesize

              856KB

            • memory/2512-26-0x0000000003CF0000-0x0000000003D39000-memory.dmp

              Filesize

              292KB

            • memory/2512-27-0x0000000003CF0000-0x0000000003D39000-memory.dmp

              Filesize

              292KB

            • memory/2512-28-0x0000000003CF0000-0x0000000003D39000-memory.dmp

              Filesize

              292KB

            • memory/2512-29-0x0000000003CF0000-0x0000000003D39000-memory.dmp

              Filesize

              292KB

            • memory/2512-30-0x0000000003CF0000-0x0000000003D39000-memory.dmp

              Filesize

              292KB

            • memory/2512-31-0x0000000003CF0000-0x0000000003D39000-memory.dmp

              Filesize

              292KB