Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:05
Static task
static1
Behavioral task
behavioral1
Sample
a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe
Resource
win10v2004-20240426-en
General
-
Target
a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe
-
Size
873KB
-
MD5
fc1fb033d57f72089fb4762245a8b18d
-
SHA1
7ec0f7ca5f0e0d20e5372bf69865d0a809e6cc8e
-
SHA256
a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2
-
SHA512
cff3833e592a5fe1f1fcb656c42e77fdd177c902f84cf396365cfa04edc9ec046de3473a943779d3815bc36bf48182101703b20b08ae580c2b3ba20508d231d0
-
SSDEEP
24576:g2DW/xbWX2YIb3Qsu3/PNL3Q7HybtTpAA+c:g2EaXSQsW/PNjQLY9ARc
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
makecab.exedescription ioc process File created C:\Windows\Logs\CBS\CbsPersist_20240522020518.cab makecab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exea6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exea6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exepid process 2004 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe 2428 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe 2428 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe 2916 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe 2916 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exea6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exepid process 2004 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe 2172 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exea6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exedescription pid process Token: SeDebugPrivilege 2428 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe Token: SeAssignPrimaryTokenPrivilege 2428 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe Token: SeIncreaseQuotaPrivilege 2428 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe Token: 0 2428 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe Token: SeDebugPrivilege 2916 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe Token: SeAssignPrimaryTokenPrivilege 2916 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe Token: SeIncreaseQuotaPrivilege 2916 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exedescription pid process target process PID 2004 wrote to memory of 2428 2004 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe PID 2004 wrote to memory of 2428 2004 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe PID 2004 wrote to memory of 2428 2004 a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe"C:\Users\Admin\AppData\Local\Temp\a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe"C:\Users\Admin\AppData\Local\Temp\a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe" /P:3935062⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe"C:\Users\Admin\AppData\Local\Temp\a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe" /P:3935063⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe"C:\Users\Admin\AppData\Local\Temp\a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.exe" /TI/ /P:3935064⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240522020518.log C:\Windows\Logs\CBS\CbsPersist_20240522020518.cab1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2o0w0r4b.tmpFilesize
28KB
MD59e7bb9c31083cc3a0f561d12311c9d83
SHA19102b88339566d5f0490c25180632043c8bb1809
SHA2562658178fd2cb498195032c531bf3bb037954e0614aaec4c4ac2637f08d949bc1
SHA5121fb30279a1f951a98f609eb749deb6c77082c28a30e1fdd4f3224ddac8ddfad134e8f3c44f82c32501da8a93a978e6cf8dfe591039a0e6af0d4d2a1dc5445699
-
C:\Users\Admin\AppData\Local\Temp\a6fa768c4964c328c748558627c20c2ba455e589a1b87cfa3911d197da1688d2.iniFilesize
3KB
MD5466f41eb88c093a7f0b44652dab146d2
SHA1138bfe704c2ae18293973bfcc6c10907e64b5783
SHA256de222e77b3ac32b56593e9908e48e6bbc4e0e4712f460e0fd4cca8255b5ea556
SHA512ac1dd4d5192036b5c118667a1a8387e44869b521908ee628c77f5ca909e2587b8cdf5797bf3e6fe10cee8e87dcc21d84ea31a812a83f560dbb70d7271b8d7004
-
C:\Windows\Temp\2o9w1r6b.tmpFilesize
28KB
MD51524a28cbc30e70c60bc6cf977f82229
SHA1664f15cea146b654ec4a60c76071ff83c4dfa651
SHA2568561191653adc4ee6cb03a5c1953bd993782689600adebcd8776754147668f9b
SHA5127fbee3bc38aca8ef368c1ff07eb1f4fb3f178628f8b41430eb1006c63bd908f26a1d85a19f2d661b02d3842505c9c762c8056fb2f1619b92a3a6d1085f0b9c50
-
C:\Windows\Temp\2o9w1r6b.tmpFilesize
28KB
MD5db2eb3078f924bc0049ae6e98653f2b0
SHA1fc058c55c2b670dea826418aebc602ad737f6285
SHA256f37b5230deb0e25cd3721e8b6653036b26dde8c7d567e4639458192daacef9f7
SHA512dca8ec245c856def9ff56536537b91456c967966939e94b602c085282ebbe5c95e12bb9f48772d3dbd43087ce3317debdc87bf635f3972b048ea4ec811d1b50a
-
C:\Windows\Temp\aut10F2.tmpFilesize
11KB
MD54a83df1d945c2f5801ed59650d7460eb
SHA131827890e1df99268c0f80dcb26774225e4c3a5d
SHA2562d993be76dfcf35f89b656b4dbc553e078d824974b482e56c6f76eaea87731c8
SHA512eacb88683e3c999a1cdc9d9e4a4030723164e358d7cd85f7cfc02b99f33be991c89af5602349b48b5388520968a43a2a45b4b6d2f468f2b888088cf95bd591d2
-
C:\Windows\Temp\aut10F3.tmpFilesize
10KB
MD509ca17eb552722bd7004097f59b07518
SHA136cf9da188460542e58acb97fa0ef0bfd9a4e172
SHA256365c32c3c09228158ab5aaabfcf93cdfcd858be0b2a00031d82ab03070f61a5b
SHA5123dc6ed86df50f87b12635032fb30840e94bea699ac193a16099a2ce1a9bd5e39147f115fb938c177991dc0dcfd5abab075632a1d0b46e6009a86eea3a27156bf
-
C:\Windows\Temp\aut1103.tmpFilesize
5KB
MD596c0e61f3298cb745b021f67e7dd0d48
SHA1a61adbe460c68a3087ff1ba75620dbb86af28e40
SHA2563e56c22a81ab1168036a289c7ffe2889dd678c422568dff9ef91d6a0f9005333
SHA512dbbfdd4ad2c80ff9df0b21dfd011420baba54a7114d0e0ff5371dda9c9389d90422a4311881ac2bdb5ba7c4334d210b61c6c0fc691ae503e32930109d9251f3e