Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 06:05
Static task
static1
Behavioral task
behavioral1
Sample
c529c0a7990ed68d0c554095caf798fb.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
c529c0a7990ed68d0c554095caf798fb.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/hovoyln.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/hovoyln.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
c529c0a7990ed68d0c554095caf798fb.exe
-
Size
708KB
-
MD5
c529c0a7990ed68d0c554095caf798fb
-
SHA1
87835e95ac75bcedb24cb8262513ea976567f40c
-
SHA256
130dff80cf9bc9a5acab926c0bd69941cc381f5c6999117e4f3730409d5d13b3
-
SHA512
2d6de544b66700d5f013a4dd1f5c981da9708bd44851918eddd89b18d9cd44c840f05e68200b9fb9ce85876c287ea7afa6141968cc92f87a7ba815e4a25f106d
-
SSDEEP
12288:aCf1W7zQImcgeZdisgm5T40xHeNNVEhhvl7/xjwzhdwfc8vy4hf:aWKF4eZ4s9O8eNXALxjwz586a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1728 bedhbacbca.exe -
Loads dropped DLL 11 IoCs
pid Process 1952 c529c0a7990ed68d0c554095caf798fb.exe 1952 c529c0a7990ed68d0c554095caf798fb.exe 1952 c529c0a7990ed68d0c554095caf798fb.exe 1952 c529c0a7990ed68d0c554095caf798fb.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2804 1728 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2664 wmic.exe Token: SeSecurityPrivilege 2664 wmic.exe Token: SeTakeOwnershipPrivilege 2664 wmic.exe Token: SeLoadDriverPrivilege 2664 wmic.exe Token: SeSystemProfilePrivilege 2664 wmic.exe Token: SeSystemtimePrivilege 2664 wmic.exe Token: SeProfSingleProcessPrivilege 2664 wmic.exe Token: SeIncBasePriorityPrivilege 2664 wmic.exe Token: SeCreatePagefilePrivilege 2664 wmic.exe Token: SeBackupPrivilege 2664 wmic.exe Token: SeRestorePrivilege 2664 wmic.exe Token: SeShutdownPrivilege 2664 wmic.exe Token: SeDebugPrivilege 2664 wmic.exe Token: SeSystemEnvironmentPrivilege 2664 wmic.exe Token: SeRemoteShutdownPrivilege 2664 wmic.exe Token: SeUndockPrivilege 2664 wmic.exe Token: SeManageVolumePrivilege 2664 wmic.exe Token: 33 2664 wmic.exe Token: 34 2664 wmic.exe Token: 35 2664 wmic.exe Token: SeIncreaseQuotaPrivilege 2664 wmic.exe Token: SeSecurityPrivilege 2664 wmic.exe Token: SeTakeOwnershipPrivilege 2664 wmic.exe Token: SeLoadDriverPrivilege 2664 wmic.exe Token: SeSystemProfilePrivilege 2664 wmic.exe Token: SeSystemtimePrivilege 2664 wmic.exe Token: SeProfSingleProcessPrivilege 2664 wmic.exe Token: SeIncBasePriorityPrivilege 2664 wmic.exe Token: SeCreatePagefilePrivilege 2664 wmic.exe Token: SeBackupPrivilege 2664 wmic.exe Token: SeRestorePrivilege 2664 wmic.exe Token: SeShutdownPrivilege 2664 wmic.exe Token: SeDebugPrivilege 2664 wmic.exe Token: SeSystemEnvironmentPrivilege 2664 wmic.exe Token: SeRemoteShutdownPrivilege 2664 wmic.exe Token: SeUndockPrivilege 2664 wmic.exe Token: SeManageVolumePrivilege 2664 wmic.exe Token: 33 2664 wmic.exe Token: 34 2664 wmic.exe Token: 35 2664 wmic.exe Token: SeIncreaseQuotaPrivilege 1996 wmic.exe Token: SeSecurityPrivilege 1996 wmic.exe Token: SeTakeOwnershipPrivilege 1996 wmic.exe Token: SeLoadDriverPrivilege 1996 wmic.exe Token: SeSystemProfilePrivilege 1996 wmic.exe Token: SeSystemtimePrivilege 1996 wmic.exe Token: SeProfSingleProcessPrivilege 1996 wmic.exe Token: SeIncBasePriorityPrivilege 1996 wmic.exe Token: SeCreatePagefilePrivilege 1996 wmic.exe Token: SeBackupPrivilege 1996 wmic.exe Token: SeRestorePrivilege 1996 wmic.exe Token: SeShutdownPrivilege 1996 wmic.exe Token: SeDebugPrivilege 1996 wmic.exe Token: SeSystemEnvironmentPrivilege 1996 wmic.exe Token: SeRemoteShutdownPrivilege 1996 wmic.exe Token: SeUndockPrivilege 1996 wmic.exe Token: SeManageVolumePrivilege 1996 wmic.exe Token: 33 1996 wmic.exe Token: 34 1996 wmic.exe Token: 35 1996 wmic.exe Token: SeIncreaseQuotaPrivilege 2628 wmic.exe Token: SeSecurityPrivilege 2628 wmic.exe Token: SeTakeOwnershipPrivilege 2628 wmic.exe Token: SeLoadDriverPrivilege 2628 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1728 1952 c529c0a7990ed68d0c554095caf798fb.exe 28 PID 1952 wrote to memory of 1728 1952 c529c0a7990ed68d0c554095caf798fb.exe 28 PID 1952 wrote to memory of 1728 1952 c529c0a7990ed68d0c554095caf798fb.exe 28 PID 1952 wrote to memory of 1728 1952 c529c0a7990ed68d0c554095caf798fb.exe 28 PID 1728 wrote to memory of 2664 1728 bedhbacbca.exe 29 PID 1728 wrote to memory of 2664 1728 bedhbacbca.exe 29 PID 1728 wrote to memory of 2664 1728 bedhbacbca.exe 29 PID 1728 wrote to memory of 2664 1728 bedhbacbca.exe 29 PID 1728 wrote to memory of 1996 1728 bedhbacbca.exe 32 PID 1728 wrote to memory of 1996 1728 bedhbacbca.exe 32 PID 1728 wrote to memory of 1996 1728 bedhbacbca.exe 32 PID 1728 wrote to memory of 1996 1728 bedhbacbca.exe 32 PID 1728 wrote to memory of 2628 1728 bedhbacbca.exe 34 PID 1728 wrote to memory of 2628 1728 bedhbacbca.exe 34 PID 1728 wrote to memory of 2628 1728 bedhbacbca.exe 34 PID 1728 wrote to memory of 2628 1728 bedhbacbca.exe 34 PID 1728 wrote to memory of 2476 1728 bedhbacbca.exe 36 PID 1728 wrote to memory of 2476 1728 bedhbacbca.exe 36 PID 1728 wrote to memory of 2476 1728 bedhbacbca.exe 36 PID 1728 wrote to memory of 2476 1728 bedhbacbca.exe 36 PID 1728 wrote to memory of 2084 1728 bedhbacbca.exe 38 PID 1728 wrote to memory of 2084 1728 bedhbacbca.exe 38 PID 1728 wrote to memory of 2084 1728 bedhbacbca.exe 38 PID 1728 wrote to memory of 2084 1728 bedhbacbca.exe 38 PID 1728 wrote to memory of 2804 1728 bedhbacbca.exe 40 PID 1728 wrote to memory of 2804 1728 bedhbacbca.exe 40 PID 1728 wrote to memory of 2804 1728 bedhbacbca.exe 40 PID 1728 wrote to memory of 2804 1728 bedhbacbca.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\c529c0a7990ed68d0c554095caf798fb.exe"C:\Users\Admin\AppData\Local\Temp\c529c0a7990ed68d0c554095caf798fb.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\bedhbacbca.exeC:\Users\Admin\AppData\Local\Temp\bedhbacbca.exe 4,9,0,5,9,0,2,2,4,0,9 K0dJPzQxNzEyMxcrSlU9R0lCOywgJko8VFJGUklHQD0oISkwa2lvYnNfdGVdZGU4SWVna11nXBwmRERKVEdCOTIuMygyGyZDR0I5MBcrR1JKO1VBUltJOzkpNjQrMx4tT0VJUjxSWkxSSjtkdGtsMS8qanJ0LEBFSkckVEpHLT9OTC5ASj1PGyZDSkc/S0BANCAqOzE7Ky0gJkApPSgoIC1CLz0kLRcvPys9Ky8cLzsxNC0sFy9OUEtETD9LX0tJSVQ/P1k0HCZQTUZEU0FQXzxRQ0E4Fy9OUEtETD9LX0k4TUM7HC88VDxfUElMOx4rRU9BVkNIO0xHTEE9Fys/T05LX0BQS1dKQUk9MBcvUkY9TkJVRlVaTFJKOxwvTUk0MhsmRFEvOSAmTkxOT0BNQ11TRUM/Rk1AQE0/RUFVSUg0ICpAU11QUU5LRURFOGtyc2McL0lBS1VNRUlMRVtVSkFJXz84WVE7LiAmREBEQE89Lx4rSUpbO1lJOE1HQVtFRT9JWUtLRUI7YmFjb1wgKjtPVUxITzhAVklLNDEvNioxKjMlMSsrLi80LCAmTDhSPENMQ0pbSUVPS0FHQz1kX2hzXBwmVERERTsvMDMuLSc4Li01Hi1AT05KQ088O19SR0lFNDMmMTImMi4vMSorNis2NSc1KD9J2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710309916.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710309916.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710309916.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710309916.txt bios get version3⤵PID:2476
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710309916.txt bios get version3⤵PID:2084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:2804
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
1.1MB
MD5591ba0fa5a6f338aa8384604e680af54
SHA1411c23e1b31d7ef665f0d478d3b80a7805186247
SHA2563df6890248bc9a18810642d5ed45ffeb5a1d6bb92023639a0730ee92cf73a0e1
SHA51263b4f9e97c2f129e4840b910a643dcb1329194c620db324b358e9c607a408f1282c0894162cc84c8b2825303d4c509f0e154392ff4f39dcefa7c338f8e49bbc7
-
Filesize
153KB
MD5e9a8475b034021362ec21c66375fe428
SHA1e256a7099d2202b9d8eb67a5fdc287407c63b8c5
SHA256657261a73c565507a57db654c43e6724fef7884b72a5b3163d5b31ad85a3baa4
SHA512480fd7de9cbb3c07955fe3aa4cd7e7b8b5eca25266300ed8b010941eaa75bf81e751c555968e2fd3b33a885ab178a019d6a71a1a5c43891bfc92ebdad89d1621
-
Filesize
163KB
MD52dc35ddcabcb2b24919b9afae4ec3091
SHA19eeed33c3abc656353a7ebd1c66af38cccadd939
SHA2566bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA5120ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901