Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 04:13
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
begcabjfeh.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
begcabjfeh.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
setup.exe
-
Size
288KB
-
MD5
872e58dd33a3081dc776b1ee24563ed6
-
SHA1
3eb3f0f4a5c85fb5bf70ba246ef8b00cb8e333cd
-
SHA256
3b697fa2d82d29c0f9b1281af5a8d0d02eeac16ac26e3ea49715e6751707d7ee
-
SHA512
bc1abc1a1e488080fcf0d4a08dcf27ef821254f0d2f6ffe79733f14a8ec25fb46514c8b13ca6db3a11fcd41b7effee012b241c0b3c7822e7e54cf5c74b2e6d84
-
SSDEEP
6144:FFJ0PySE16vzeEdhxK9nf5LMuRA/TuX3LzY1cagPNdxL9s:wySE167/w9nBgLSX4VgPNO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2008 begcabjfeh.exe -
Loads dropped DLL 5 IoCs
pid Process 840 setup.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2140 2008 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2076 wmic.exe Token: SeSecurityPrivilege 2076 wmic.exe Token: SeTakeOwnershipPrivilege 2076 wmic.exe Token: SeLoadDriverPrivilege 2076 wmic.exe Token: SeSystemProfilePrivilege 2076 wmic.exe Token: SeSystemtimePrivilege 2076 wmic.exe Token: SeProfSingleProcessPrivilege 2076 wmic.exe Token: SeIncBasePriorityPrivilege 2076 wmic.exe Token: SeCreatePagefilePrivilege 2076 wmic.exe Token: SeBackupPrivilege 2076 wmic.exe Token: SeRestorePrivilege 2076 wmic.exe Token: SeShutdownPrivilege 2076 wmic.exe Token: SeDebugPrivilege 2076 wmic.exe Token: SeSystemEnvironmentPrivilege 2076 wmic.exe Token: SeRemoteShutdownPrivilege 2076 wmic.exe Token: SeUndockPrivilege 2076 wmic.exe Token: SeManageVolumePrivilege 2076 wmic.exe Token: 33 2076 wmic.exe Token: 34 2076 wmic.exe Token: 35 2076 wmic.exe Token: SeIncreaseQuotaPrivilege 2076 wmic.exe Token: SeSecurityPrivilege 2076 wmic.exe Token: SeTakeOwnershipPrivilege 2076 wmic.exe Token: SeLoadDriverPrivilege 2076 wmic.exe Token: SeSystemProfilePrivilege 2076 wmic.exe Token: SeSystemtimePrivilege 2076 wmic.exe Token: SeProfSingleProcessPrivilege 2076 wmic.exe Token: SeIncBasePriorityPrivilege 2076 wmic.exe Token: SeCreatePagefilePrivilege 2076 wmic.exe Token: SeBackupPrivilege 2076 wmic.exe Token: SeRestorePrivilege 2076 wmic.exe Token: SeShutdownPrivilege 2076 wmic.exe Token: SeDebugPrivilege 2076 wmic.exe Token: SeSystemEnvironmentPrivilege 2076 wmic.exe Token: SeRemoteShutdownPrivilege 2076 wmic.exe Token: SeUndockPrivilege 2076 wmic.exe Token: SeManageVolumePrivilege 2076 wmic.exe Token: 33 2076 wmic.exe Token: 34 2076 wmic.exe Token: 35 2076 wmic.exe Token: SeIncreaseQuotaPrivilege 2596 wmic.exe Token: SeSecurityPrivilege 2596 wmic.exe Token: SeTakeOwnershipPrivilege 2596 wmic.exe Token: SeLoadDriverPrivilege 2596 wmic.exe Token: SeSystemProfilePrivilege 2596 wmic.exe Token: SeSystemtimePrivilege 2596 wmic.exe Token: SeProfSingleProcessPrivilege 2596 wmic.exe Token: SeIncBasePriorityPrivilege 2596 wmic.exe Token: SeCreatePagefilePrivilege 2596 wmic.exe Token: SeBackupPrivilege 2596 wmic.exe Token: SeRestorePrivilege 2596 wmic.exe Token: SeShutdownPrivilege 2596 wmic.exe Token: SeDebugPrivilege 2596 wmic.exe Token: SeSystemEnvironmentPrivilege 2596 wmic.exe Token: SeRemoteShutdownPrivilege 2596 wmic.exe Token: SeUndockPrivilege 2596 wmic.exe Token: SeManageVolumePrivilege 2596 wmic.exe Token: 33 2596 wmic.exe Token: 34 2596 wmic.exe Token: 35 2596 wmic.exe Token: SeIncreaseQuotaPrivilege 2772 wmic.exe Token: SeSecurityPrivilege 2772 wmic.exe Token: SeTakeOwnershipPrivilege 2772 wmic.exe Token: SeLoadDriverPrivilege 2772 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 840 wrote to memory of 2008 840 setup.exe 28 PID 840 wrote to memory of 2008 840 setup.exe 28 PID 840 wrote to memory of 2008 840 setup.exe 28 PID 840 wrote to memory of 2008 840 setup.exe 28 PID 2008 wrote to memory of 2076 2008 begcabjfeh.exe 29 PID 2008 wrote to memory of 2076 2008 begcabjfeh.exe 29 PID 2008 wrote to memory of 2076 2008 begcabjfeh.exe 29 PID 2008 wrote to memory of 2076 2008 begcabjfeh.exe 29 PID 2008 wrote to memory of 2596 2008 begcabjfeh.exe 32 PID 2008 wrote to memory of 2596 2008 begcabjfeh.exe 32 PID 2008 wrote to memory of 2596 2008 begcabjfeh.exe 32 PID 2008 wrote to memory of 2596 2008 begcabjfeh.exe 32 PID 2008 wrote to memory of 2772 2008 begcabjfeh.exe 34 PID 2008 wrote to memory of 2772 2008 begcabjfeh.exe 34 PID 2008 wrote to memory of 2772 2008 begcabjfeh.exe 34 PID 2008 wrote to memory of 2772 2008 begcabjfeh.exe 34 PID 2008 wrote to memory of 2652 2008 begcabjfeh.exe 36 PID 2008 wrote to memory of 2652 2008 begcabjfeh.exe 36 PID 2008 wrote to memory of 2652 2008 begcabjfeh.exe 36 PID 2008 wrote to memory of 2652 2008 begcabjfeh.exe 36 PID 2008 wrote to memory of 2408 2008 begcabjfeh.exe 38 PID 2008 wrote to memory of 2408 2008 begcabjfeh.exe 38 PID 2008 wrote to memory of 2408 2008 begcabjfeh.exe 38 PID 2008 wrote to memory of 2408 2008 begcabjfeh.exe 38 PID 2008 wrote to memory of 2140 2008 begcabjfeh.exe 40 PID 2008 wrote to memory of 2140 2008 begcabjfeh.exe 40 PID 2008 wrote to memory of 2140 2008 begcabjfeh.exe 40 PID 2008 wrote to memory of 2140 2008 begcabjfeh.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\begcabjfeh.exeC:\Users\Admin\AppData\Local\Temp\begcabjfeh.exe 1)1)8)3)3)8)9)7)3)1)5 Lk9BQTopMDExMRsuUk0/TUE7Ni0fKk1ETFRMSkJCQTwsHy48RlBMQD06MTQ1MCgdLDtAPTovGy5PSkxBTTpNXEg/PDEwNTMtFyhQRE1VREpcUkpDNmVzb285JyxkXWsnYWRuaixsbG0lWGltcilobV5sHSc6RUZCRkhDNR0sPCg2KjAbLkMqOiopFyhBMjgsMBgsQSw0Ji4fKkM0NSouGCZJT04/VEJMXE1KQE8+QlQ8HydNT0c7TkBTWkRURD46GCZJT04/VEJMXEs5RD46anFocmdjcR0pKWNrZG9hZ2xoHSkpamBmZHEdLy1oaWgiMSszLSsrMSYnHi8vIDEvHS8tW2laYGohZWhkYmtZZF46anFocmdjcR0pKWNrGy5EUEJcTUlFOmFgcnMsbWAmWmhqLm5kc21tK11vXh0uQFdEV0BKPENCS0Q4Hy5ATFBMVjtPTlJSREo6LRgmTUVASUpYR1JcTUlFOh8qVUw1Lx0nO0wuPBsuUU1LUUFEPlxWQEtCR0pCQUQ6RERQUUs1HSxBSlhPVElTSEVCOmxpbmIfKlFETFJPRkBHRF5QUkRKXEE5UEw6MRsuR0FBQlA0Kh0uRFJePFZLOURCQF5ATUJKVk1MPD06ZVxrcl0dLDxGUEtLSkBDV0ZNNSgpNS0wOC0pLSspKTIdLktAUTlJST1DWEZNTlNAREk6bGluYh8qU0hFQjopKy8vMiwwMi8uHSc7SFRNR05APFxRQUQ+OjQqMi4qLS4uITI3MjE5MCknTUU=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714882405.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714882405.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714882405.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714882405.txt bios get version3⤵PID:2652
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714882405.txt bios get version3⤵PID:2408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:2140
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
572KB
MD56bf07399c81bdbc7b2eb15593d16682a
SHA16ce1a75917f90fd296b6f223f3d770c44c3dedad
SHA256d7994191f8acb48b335346017afa50687e75dab488a4b2e344c1e00a15542e14
SHA512e382ba3f6445a22cb578c7cf97087d8bd14bfd3de38e6d34fba9a9caf1662656e09d20a8c83d485cc999bda840ae907534deb501288fccf361eca9a7f3cc706c