Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2024, 13:46

General

  • Target

    cb901beffae5e9ff1b5317d3ba41d2f8.exe

  • Size

    581KB

  • MD5

    cb901beffae5e9ff1b5317d3ba41d2f8

  • SHA1

    e86102ba68257d010bb2c8f9847eca21ea516c59

  • SHA256

    222654b647728d5fc10caa1d1697d07674542e13d79a9dbf0eb94a2c33480d07

  • SHA512

    137f7c79e6d9b7b2e2a7439fed276c998c16b090cff50c0309a664bf11388d0b66a8423add87a10cbef21a715923bd473bd5f2c488cb63c967fb88ae0ad98f1d

  • SSDEEP

    12288:VQDJhNH8ZkXWykEr8369tNFMP8NdHXpZ2achJC4+e:VqJbl+36tKPdhJ7V

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb901beffae5e9ff1b5317d3ba41d2f8.exe
    "C:\Users\Admin\AppData\Local\Temp\cb901beffae5e9ff1b5317d3ba41d2f8.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\1431831751.exe
      C:\Users\Admin\AppData\Local\Temp\1431831751.exe 6,9,1,4,2,4,9,4,2,5,6 KUdIQDsvJy4wGylNTEFMR0A0LB4qSD9LVktQR0BAOysaKTtIT1JFOzkwMiwxKR8rQUU7OS4bKUpJTkBTP0tbRz83Ky04MB4rSkFQUT9MVlROSjlfcHJrNCkmcm50KjtBUUYnTkZPKT9MRypHSUBJFy4/SkU6R0c/N3FLMDRGLkRQSTNJP0ZKNUksKVIyRT9ILx8rQi00LS8rKi8XLkAwOSQtHio+LTQsLR4rOzA7KCsaJkMxOykoHC1LTEk7VD9SW0dOR1E7PVA8HC1MSUtCUD1OVkRRSj00HC1LTEk7VD9SW0U9S0A3GiZEVENbTE5KOBopPFdBXT9EQEpESD80HytGS0pQXT1MSU5SQVA5JxwtT0I7RUpVTVFWUVBHNxomVUk7LhcrQk4rNxcuTlNKS0VLQFlRPEs/TUk8RUs8QT9MUUg7HCZFUVpMT0VTRUtBNHBwcF8aJlFBUlFJSkdJQVlMUkFQWzs9V043LBcuREdAPFQ7LBopQFJbQlVFPUtEPVk8TT9QVUdQQz83YFhrb2McJkBNUkhGRkBAXUVHOTQxKCsnMSo2KikwMxspTkBMQTstKy8vMy0vMC8vHis7S1VJRkk4Q1tSRURBOzApKy4uLi4tLCYyNSsrMTMvKD1EHC1QOzdEbnZnaGNdIy1gLyUvJyZTYGpianFtIk1QKTIlLSMuXCVOTlM0MBwvYCZObGBjYWxwHC5kMigqHDJeKW5tITFcKyslLyExXiJDUj0xKCwoJ2plYmEpQl9dYm4cLVFJSDtjbm5nJC9fISliIy1gYVxzLSwsKC0vX19tYGZqLGVlYm0gLGBJdGpSZWRhQmpxaGNuXWJJWGpfYl9sVmNhbmhmdSMtYCsrMi02Lyw1LjAfLF1ja3VqY2tfX2dbZWBjY24cLmQsLi0oNy8zNScxIy5gKycvNTAxJzUwMS5UZFUsUGZMck4tXTFDUnN2SWBWYEpzKipKUFNvQGlxNEdNJzJId1ZjS3dqY1NxRDVJPy9uSz5xZU9oMDZIS0FiVGMuMEk/NmNQQEs0Rk1ealR4USdHd25jVE5rb1ZDb19gUXExWVZCeGBPPWJUUV5nVmlqZlBAdi5QPV4xTXhGPFFpUCpOYlVMT2ZbQ0s+Zk9DalZDUGFjYlUrL21ZUHFv
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81710510408.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2648
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81710510408.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1164
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81710510408.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2780
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81710510408.txt bios get version
        3⤵
          PID:2360
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81710510408.txt bios get version
          3⤵
            PID:2476
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 368
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:2432

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81710510408.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\1431831751.exe

        Filesize

        788KB

        MD5

        8890fe58240790af20b7006c537a69a2

        SHA1

        aebb9a5cbd652634e017bbe57d1ba032b90f5a5b

        SHA256

        747baf72bd89b1dc09ec74093aad6249b2ee983e56cb730476a107ee5024be27

        SHA512

        ddf24bf4004148b7f90b4659bc2cd59cc97c3fa9b1c75d2bfdb89d0547ecb1b62405d5258f6ea7c4e18c3892cb1cb7c4fb354f34a091325ca9b940d99eafb074

      • \Users\Admin\AppData\Local\Temp\nsy1095.tmp\cgibuti.dll

        Filesize

        153KB

        MD5

        9b081b4f84974a46cffcf1ef1a2e85f9

        SHA1

        70a1b83bad19d28195f2df22c3d213a04b42fb2b

        SHA256

        303f74df9812b639b66f919804039d1e295ffae8e543fa4349507110ac766752

        SHA512

        4539a458b1d2ba61ffcf71ea59addd13727d26606f73dbfb21053d68d5656010dae5791d486789c14653c6fb953a7dc284c3a80db2b1970a0e7f0778ab77dbbf

      • \Users\Admin\AppData\Local\Temp\nsy1095.tmp\nsisunz.dll

        Filesize

        40KB

        MD5

        5f13dbc378792f23e598079fc1e4422b

        SHA1

        5813c05802f15930aa860b8363af2b58426c8adf

        SHA256

        6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

        SHA512

        9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5