Analysis
-
max time kernel
132s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 17:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe
-
Size
1.0MB
-
MD5
7df78e5e3b0ceedc16e6702577563b83
-
SHA1
63ed52a3ed7bfa427620a9be8e4af93d8d427336
-
SHA256
1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459
-
SHA512
f979635c3364cb77f8c5a3bcc8762e2f186c2ea15d9f4f28a0a3e09c337f647b83a6ae6b18310f5a4716d2caf30bea5c8a94a43a251a7a76cd51f36193937b82
-
SSDEEP
24576:KqnoPBeRKRcVECoZwDdWfeaoqO/6OocT+e6Z:K6VEXwDPaoqOgcCZ
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2924 1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe 2924 1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3036 WMIC.exe Token: SeSecurityPrivilege 3036 WMIC.exe Token: SeTakeOwnershipPrivilege 3036 WMIC.exe Token: SeLoadDriverPrivilege 3036 WMIC.exe Token: SeSystemProfilePrivilege 3036 WMIC.exe Token: SeSystemtimePrivilege 3036 WMIC.exe Token: SeProfSingleProcessPrivilege 3036 WMIC.exe Token: SeIncBasePriorityPrivilege 3036 WMIC.exe Token: SeCreatePagefilePrivilege 3036 WMIC.exe Token: SeBackupPrivilege 3036 WMIC.exe Token: SeRestorePrivilege 3036 WMIC.exe Token: SeShutdownPrivilege 3036 WMIC.exe Token: SeDebugPrivilege 3036 WMIC.exe Token: SeSystemEnvironmentPrivilege 3036 WMIC.exe Token: SeRemoteShutdownPrivilege 3036 WMIC.exe Token: SeUndockPrivilege 3036 WMIC.exe Token: SeManageVolumePrivilege 3036 WMIC.exe Token: 33 3036 WMIC.exe Token: 34 3036 WMIC.exe Token: 35 3036 WMIC.exe Token: SeIncreaseQuotaPrivilege 3036 WMIC.exe Token: SeSecurityPrivilege 3036 WMIC.exe Token: SeTakeOwnershipPrivilege 3036 WMIC.exe Token: SeLoadDriverPrivilege 3036 WMIC.exe Token: SeSystemProfilePrivilege 3036 WMIC.exe Token: SeSystemtimePrivilege 3036 WMIC.exe Token: SeProfSingleProcessPrivilege 3036 WMIC.exe Token: SeIncBasePriorityPrivilege 3036 WMIC.exe Token: SeCreatePagefilePrivilege 3036 WMIC.exe Token: SeBackupPrivilege 3036 WMIC.exe Token: SeRestorePrivilege 3036 WMIC.exe Token: SeShutdownPrivilege 3036 WMIC.exe Token: SeDebugPrivilege 3036 WMIC.exe Token: SeSystemEnvironmentPrivilege 3036 WMIC.exe Token: SeRemoteShutdownPrivilege 3036 WMIC.exe Token: SeUndockPrivilege 3036 WMIC.exe Token: SeManageVolumePrivilege 3036 WMIC.exe Token: 33 3036 WMIC.exe Token: 34 3036 WMIC.exe Token: 35 3036 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2924 1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe 2924 1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2704 2924 1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe 31 PID 2924 wrote to memory of 2704 2924 1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe 31 PID 2924 wrote to memory of 2704 2924 1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe 31 PID 2924 wrote to memory of 2704 2924 1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe 31 PID 2704 wrote to memory of 3036 2704 cmd.exe 33 PID 2704 wrote to memory of 3036 2704 cmd.exe 33 PID 2704 wrote to memory of 3036 2704 cmd.exe 33 PID 2704 wrote to memory of 3036 2704 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe"C:\Users\Admin\AppData\Local\Temp\1fb540e1b2088a1cbe86bc308bc35069e95936246f93b1ebf9683e275e00b459.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.execmd.exe /c Wmic Path Win32_VideoController Get Description2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWmic Path Win32_VideoController Get Description3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-