Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 16:20
Static task
static1
Behavioral task
behavioral1
Sample
Newsoftwares.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Newsoftwares.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
befeejabed.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
befeejabed.exe
Resource
win10v2004-20240508-en
General
-
Target
befeejabed.exe
-
Size
568KB
-
MD5
a4e3d3ccd35ed83abdcc004db2092b2d
-
SHA1
f289a9a1d5aabeadd3d868ae0af099bf2e31a5e3
-
SHA256
e456949843d43f8bc31d575ba43ce788ebe6ca54aa11db78e480ce94553ab47f
-
SHA512
1325f969f66bc952ab0f23d29f6d83b1fd2277948de588f809582f2650a5373a0dd2d8d0b1a02c66f6fd3c5e98de59c961f21e68130813d1c5a7f50bdb74be7c
-
SSDEEP
12288:/SzxLuErJ8Cu2U3BkvOu4gLQwwL7wz0+5C8h5FV5Oiomj:/Wd8Cp4SQwwLc68/nj
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2988 264 WerFault.exe befeejabed.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 4600 wmic.exe Token: SeSecurityPrivilege 4600 wmic.exe Token: SeTakeOwnershipPrivilege 4600 wmic.exe Token: SeLoadDriverPrivilege 4600 wmic.exe Token: SeSystemProfilePrivilege 4600 wmic.exe Token: SeSystemtimePrivilege 4600 wmic.exe Token: SeProfSingleProcessPrivilege 4600 wmic.exe Token: SeIncBasePriorityPrivilege 4600 wmic.exe Token: SeCreatePagefilePrivilege 4600 wmic.exe Token: SeBackupPrivilege 4600 wmic.exe Token: SeRestorePrivilege 4600 wmic.exe Token: SeShutdownPrivilege 4600 wmic.exe Token: SeDebugPrivilege 4600 wmic.exe Token: SeSystemEnvironmentPrivilege 4600 wmic.exe Token: SeRemoteShutdownPrivilege 4600 wmic.exe Token: SeUndockPrivilege 4600 wmic.exe Token: SeManageVolumePrivilege 4600 wmic.exe Token: 33 4600 wmic.exe Token: 34 4600 wmic.exe Token: 35 4600 wmic.exe Token: 36 4600 wmic.exe Token: SeIncreaseQuotaPrivilege 4600 wmic.exe Token: SeSecurityPrivilege 4600 wmic.exe Token: SeTakeOwnershipPrivilege 4600 wmic.exe Token: SeLoadDriverPrivilege 4600 wmic.exe Token: SeSystemProfilePrivilege 4600 wmic.exe Token: SeSystemtimePrivilege 4600 wmic.exe Token: SeProfSingleProcessPrivilege 4600 wmic.exe Token: SeIncBasePriorityPrivilege 4600 wmic.exe Token: SeCreatePagefilePrivilege 4600 wmic.exe Token: SeBackupPrivilege 4600 wmic.exe Token: SeRestorePrivilege 4600 wmic.exe Token: SeShutdownPrivilege 4600 wmic.exe Token: SeDebugPrivilege 4600 wmic.exe Token: SeSystemEnvironmentPrivilege 4600 wmic.exe Token: SeRemoteShutdownPrivilege 4600 wmic.exe Token: SeUndockPrivilege 4600 wmic.exe Token: SeManageVolumePrivilege 4600 wmic.exe Token: 33 4600 wmic.exe Token: 34 4600 wmic.exe Token: 35 4600 wmic.exe Token: 36 4600 wmic.exe Token: SeIncreaseQuotaPrivilege 4624 wmic.exe Token: SeSecurityPrivilege 4624 wmic.exe Token: SeTakeOwnershipPrivilege 4624 wmic.exe Token: SeLoadDriverPrivilege 4624 wmic.exe Token: SeSystemProfilePrivilege 4624 wmic.exe Token: SeSystemtimePrivilege 4624 wmic.exe Token: SeProfSingleProcessPrivilege 4624 wmic.exe Token: SeIncBasePriorityPrivilege 4624 wmic.exe Token: SeCreatePagefilePrivilege 4624 wmic.exe Token: SeBackupPrivilege 4624 wmic.exe Token: SeRestorePrivilege 4624 wmic.exe Token: SeShutdownPrivilege 4624 wmic.exe Token: SeDebugPrivilege 4624 wmic.exe Token: SeSystemEnvironmentPrivilege 4624 wmic.exe Token: SeRemoteShutdownPrivilege 4624 wmic.exe Token: SeUndockPrivilege 4624 wmic.exe Token: SeManageVolumePrivilege 4624 wmic.exe Token: 33 4624 wmic.exe Token: 34 4624 wmic.exe Token: 35 4624 wmic.exe Token: 36 4624 wmic.exe Token: SeIncreaseQuotaPrivilege 4624 wmic.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
befeejabed.exedescription pid process target process PID 264 wrote to memory of 4600 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 4600 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 4600 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 4624 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 4624 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 4624 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 2744 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 2744 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 2744 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 1584 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 1584 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 1584 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 3800 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 3800 264 befeejabed.exe wmic.exe PID 264 wrote to memory of 3800 264 befeejabed.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\befeejabed.exe"C:\Users\Admin\AppData\Local\Temp\befeejabed.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716308447.txt bios get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716308447.txt bios get version2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716308447.txt bios get version2⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716308447.txt bios get version2⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716308447.txt bios get version2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 6442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 264 -ip 2641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\81716308447.txtFilesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
C:\Users\Admin\AppData\Local\Temp\81716308447.txtFilesize
58B
MD5f8e2f71e123c5a848f2a83d2a7aef11e
SHA15e7a9a2937fa4f06fdf3e33d7def7de431c159b4
SHA25679dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
SHA5128d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e
-
C:\Users\Admin\AppData\Local\Temp\81716308447.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84