Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 12:46
Static task
static1
Behavioral task
behavioral1
Sample
c8a6bcf3b2840fd53db6b2343ec71c1b.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
c8a6bcf3b2840fd53db6b2343ec71c1b.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/pecvq.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/pecvq.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
c8a6bcf3b2840fd53db6b2343ec71c1b.exe
-
Size
558KB
-
MD5
c8a6bcf3b2840fd53db6b2343ec71c1b
-
SHA1
5a1fd5c3f8e4eb93df59417ce6cb5ccd6b4da7af
-
SHA256
20c23031e9453e1217ca6cfafa6721f0ca9e43539af7da541ea750fc1daeead8
-
SHA512
377bab96e1cd7329603f05823186d3ec15f9d2a969d4ce956df5ff7f3d86d8f860f11c9ba8fa05d95fe17abed50005b32f2c0c5aaa60bb422d976b1b1c6bb8ac
-
SSDEEP
12288:iCmLFCzukYszew9ed9r65hXgisl5Cx6BTEJLK5vTik:iNFCikZJS9652CcgKBV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1396 ebicabfbdfbdc.exe -
Loads dropped DLL 10 IoCs
pid Process 2228 c8a6bcf3b2840fd53db6b2343ec71c1b.exe 2228 c8a6bcf3b2840fd53db6b2343ec71c1b.exe 2228 c8a6bcf3b2840fd53db6b2343ec71c1b.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2220 1396 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3056 wmic.exe Token: SeSecurityPrivilege 3056 wmic.exe Token: SeTakeOwnershipPrivilege 3056 wmic.exe Token: SeLoadDriverPrivilege 3056 wmic.exe Token: SeSystemProfilePrivilege 3056 wmic.exe Token: SeSystemtimePrivilege 3056 wmic.exe Token: SeProfSingleProcessPrivilege 3056 wmic.exe Token: SeIncBasePriorityPrivilege 3056 wmic.exe Token: SeCreatePagefilePrivilege 3056 wmic.exe Token: SeBackupPrivilege 3056 wmic.exe Token: SeRestorePrivilege 3056 wmic.exe Token: SeShutdownPrivilege 3056 wmic.exe Token: SeDebugPrivilege 3056 wmic.exe Token: SeSystemEnvironmentPrivilege 3056 wmic.exe Token: SeRemoteShutdownPrivilege 3056 wmic.exe Token: SeUndockPrivilege 3056 wmic.exe Token: SeManageVolumePrivilege 3056 wmic.exe Token: 33 3056 wmic.exe Token: 34 3056 wmic.exe Token: 35 3056 wmic.exe Token: SeIncreaseQuotaPrivilege 3056 wmic.exe Token: SeSecurityPrivilege 3056 wmic.exe Token: SeTakeOwnershipPrivilege 3056 wmic.exe Token: SeLoadDriverPrivilege 3056 wmic.exe Token: SeSystemProfilePrivilege 3056 wmic.exe Token: SeSystemtimePrivilege 3056 wmic.exe Token: SeProfSingleProcessPrivilege 3056 wmic.exe Token: SeIncBasePriorityPrivilege 3056 wmic.exe Token: SeCreatePagefilePrivilege 3056 wmic.exe Token: SeBackupPrivilege 3056 wmic.exe Token: SeRestorePrivilege 3056 wmic.exe Token: SeShutdownPrivilege 3056 wmic.exe Token: SeDebugPrivilege 3056 wmic.exe Token: SeSystemEnvironmentPrivilege 3056 wmic.exe Token: SeRemoteShutdownPrivilege 3056 wmic.exe Token: SeUndockPrivilege 3056 wmic.exe Token: SeManageVolumePrivilege 3056 wmic.exe Token: 33 3056 wmic.exe Token: 34 3056 wmic.exe Token: 35 3056 wmic.exe Token: SeIncreaseQuotaPrivilege 2736 wmic.exe Token: SeSecurityPrivilege 2736 wmic.exe Token: SeTakeOwnershipPrivilege 2736 wmic.exe Token: SeLoadDriverPrivilege 2736 wmic.exe Token: SeSystemProfilePrivilege 2736 wmic.exe Token: SeSystemtimePrivilege 2736 wmic.exe Token: SeProfSingleProcessPrivilege 2736 wmic.exe Token: SeIncBasePriorityPrivilege 2736 wmic.exe Token: SeCreatePagefilePrivilege 2736 wmic.exe Token: SeBackupPrivilege 2736 wmic.exe Token: SeRestorePrivilege 2736 wmic.exe Token: SeShutdownPrivilege 2736 wmic.exe Token: SeDebugPrivilege 2736 wmic.exe Token: SeSystemEnvironmentPrivilege 2736 wmic.exe Token: SeRemoteShutdownPrivilege 2736 wmic.exe Token: SeUndockPrivilege 2736 wmic.exe Token: SeManageVolumePrivilege 2736 wmic.exe Token: 33 2736 wmic.exe Token: 34 2736 wmic.exe Token: 35 2736 wmic.exe Token: SeIncreaseQuotaPrivilege 2768 wmic.exe Token: SeSecurityPrivilege 2768 wmic.exe Token: SeTakeOwnershipPrivilege 2768 wmic.exe Token: SeLoadDriverPrivilege 2768 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2228 wrote to memory of 1396 2228 c8a6bcf3b2840fd53db6b2343ec71c1b.exe 28 PID 2228 wrote to memory of 1396 2228 c8a6bcf3b2840fd53db6b2343ec71c1b.exe 28 PID 2228 wrote to memory of 1396 2228 c8a6bcf3b2840fd53db6b2343ec71c1b.exe 28 PID 2228 wrote to memory of 1396 2228 c8a6bcf3b2840fd53db6b2343ec71c1b.exe 28 PID 1396 wrote to memory of 3056 1396 ebicabfbdfbdc.exe 29 PID 1396 wrote to memory of 3056 1396 ebicabfbdfbdc.exe 29 PID 1396 wrote to memory of 3056 1396 ebicabfbdfbdc.exe 29 PID 1396 wrote to memory of 3056 1396 ebicabfbdfbdc.exe 29 PID 1396 wrote to memory of 2736 1396 ebicabfbdfbdc.exe 32 PID 1396 wrote to memory of 2736 1396 ebicabfbdfbdc.exe 32 PID 1396 wrote to memory of 2736 1396 ebicabfbdfbdc.exe 32 PID 1396 wrote to memory of 2736 1396 ebicabfbdfbdc.exe 32 PID 1396 wrote to memory of 2768 1396 ebicabfbdfbdc.exe 34 PID 1396 wrote to memory of 2768 1396 ebicabfbdfbdc.exe 34 PID 1396 wrote to memory of 2768 1396 ebicabfbdfbdc.exe 34 PID 1396 wrote to memory of 2768 1396 ebicabfbdfbdc.exe 34 PID 1396 wrote to memory of 2496 1396 ebicabfbdfbdc.exe 36 PID 1396 wrote to memory of 2496 1396 ebicabfbdfbdc.exe 36 PID 1396 wrote to memory of 2496 1396 ebicabfbdfbdc.exe 36 PID 1396 wrote to memory of 2496 1396 ebicabfbdfbdc.exe 36 PID 1396 wrote to memory of 2504 1396 ebicabfbdfbdc.exe 38 PID 1396 wrote to memory of 2504 1396 ebicabfbdfbdc.exe 38 PID 1396 wrote to memory of 2504 1396 ebicabfbdfbdc.exe 38 PID 1396 wrote to memory of 2504 1396 ebicabfbdfbdc.exe 38 PID 1396 wrote to memory of 2220 1396 ebicabfbdfbdc.exe 40 PID 1396 wrote to memory of 2220 1396 ebicabfbdfbdc.exe 40 PID 1396 wrote to memory of 2220 1396 ebicabfbdfbdc.exe 40 PID 1396 wrote to memory of 2220 1396 ebicabfbdfbdc.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8a6bcf3b2840fd53db6b2343ec71c1b.exe"C:\Users\Admin\AppData\Local\Temp\c8a6bcf3b2840fd53db6b2343ec71c1b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\ebicabfbdfbdc.exeC:\Users\Admin\AppData\Local\Temp\ebicabfbdfbdc.exe 1)1)4)1)1)1)1)8)9)8)5 Lk9FQzwyLyopGCpSVD5PSEM8KBcnSURTU05RSkg8NCgbLkNFUlNIQzUpLy02MxwuQkhDNScYKk9RS0NUQlNXQDw4MDU1Mx8uUj1JTkBRXlFRSzxnbGtoNS4ub3F1LUM9SkMoU05MLEBPTyZARkFOHytCS0hCQ0A8OHZRQkdIUUtDQy09VU1CSklGMksuSC5KUhwuQzA8KScoMx8uQDE8LDAYJjwuPCwtHy5DMzUkKRsuQzE8LDAfJ0dKSkNUP1NeT1FBTTk+WDwcLk9RTjxMO09eRFFLQDwfJ0dKSkNUP1NeTUBFPDUbLkRURF5UUUQ0GCpEV0FeQkxDREBGQDwfK0dOUlNXOUpKVlJBUTwvHydLQDxNSlVOVF5USkM1Gy5VSTwxHy48Sik4Hy5OVE1TSEU8V1JESz9OTERIRTg/QFRRSDwfLkhLVkpQTVNFTEQ8c2psXRsuUUFTVFFNQUU/WlRSQVFeQ0BRSjUtHy5ESENEVzUoGCpIUltDWE1ARUA7WkRNP1FYT1M9OzVhYGtvZB8uQ0dORkdOQEBeSE88LyomLS83KjgvLTAsLhgqU0hJRDwwMyowLCswMjQvHy5DR05GR05AQF5TSEw9NCwqMDcrMS8wNCIoKTU0NTYxLylPRRcnUEA8SW55aGtkWB0tZTQqLyonVmFlXGp2cidNUyo1JigdLmEqU05WNTMdKlomU3FlY2Rtcx0pXjItLyEyYSpxbhwrXDAwKi8oKmthYl0mRmRfam4fLk1JRDhnc3BvJDJgHSleIDFlY2RzMC0oKCksY2RvaGZtLWFlXmokMWJRdG1TYWRdP252amtuYGNFWGZcZmRuXmNkb2RmcSAxZS0zMTgzKCgrMzAkLmVjbnZmY2dcY2xdbWBmZGocKmEwMy44My8wKy8pIDJlNDMwNTIvLCsuLzFUMUV5TDxILFx5bnNMQ0BwQWRFLkt5PXNNQ0RlWGJQc01QTHdHMWMtRE5ZaEdTanZKYSdwRFZEck9Scm9BZEVvTmhVckgxRChGcVBzSVIzeE1oX2xBLVltVkZFc1YqZ11KR0FlY0dNbkFkQmhZa3RsWWxEMVtNa0JRLE1PUVRSQUVmSVROaklKUT1Ia09pUUpML2tLQWRgX2FGXzNLdg==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710420374.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710420374.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710420374.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710420374.txt bios get version3⤵PID:2496
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81710420374.txt bios get version3⤵PID:2504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:2220
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
764KB
MD502f4478be48200a365d7ec28320a6cd6
SHA101ff2232d933be83a1e85d19692276c37719e1d6
SHA2563a1a70b94fae3c80b505e2bc9d86832ff9e2bb68f7d78bc77544e4bdd942afe7
SHA512e65ea616cc28327ba54fb6cd7b01ff59ff6461c4f3b7448c11167352fc9c1871d91737c9c1d90cf249c5259127c1291bd4b31fb6491f7e57e8ccf9f82c2cd69a
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
-
Filesize
126KB
MD58502136cbab8cfa9e25cca9e757ce2c4
SHA14554e9fc74c3be3baf6eb4e44baeb886694e4757
SHA256a6150805e2cc881e85069cd92cc3147fce4536c1e572b7778a40cdebfe9bf2bf
SHA51232cb48a50a55efa3f040c2fb581987b4ee5ea63fc65df7a740f04520caf18a85c7fbdefd57be5e53c325c549cd11388b56aabf6932f413b6665a0b54b779f87b