Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 20:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
begcabjfeh.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
begcabjfeh.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
setup.exe
-
Size
288KB
-
MD5
69d97fdcbb8f5977f1db480f8955d72d
-
SHA1
c8c343384dfb1558a24d84d0edc0e92fc030577c
-
SHA256
73762b97fd006d8dc92609e1706485c61411edd6c0f97d04aa72438930b2a141
-
SHA512
816a10b486d21cd3d12028c2f775e33e139964bade7a494164aa1b8fd052a81842ce0f0b2f26a5f1d372ed7a5d58957ca7a66c3bd40d02dcb966c60bf33710f3
-
SSDEEP
6144:FFJ0PqSE16vzeEdhxK9nf5LMuRA/TuX3LzY1cagPNdxL97:wqSE167/w9nBgLSX4VgPNx
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2268 begcabjfeh.exe -
Loads dropped DLL 5 IoCs
pid Process 2396 setup.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2756 2268 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language begcabjfeh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2092 wmic.exe Token: SeSecurityPrivilege 2092 wmic.exe Token: SeTakeOwnershipPrivilege 2092 wmic.exe Token: SeLoadDriverPrivilege 2092 wmic.exe Token: SeSystemProfilePrivilege 2092 wmic.exe Token: SeSystemtimePrivilege 2092 wmic.exe Token: SeProfSingleProcessPrivilege 2092 wmic.exe Token: SeIncBasePriorityPrivilege 2092 wmic.exe Token: SeCreatePagefilePrivilege 2092 wmic.exe Token: SeBackupPrivilege 2092 wmic.exe Token: SeRestorePrivilege 2092 wmic.exe Token: SeShutdownPrivilege 2092 wmic.exe Token: SeDebugPrivilege 2092 wmic.exe Token: SeSystemEnvironmentPrivilege 2092 wmic.exe Token: SeRemoteShutdownPrivilege 2092 wmic.exe Token: SeUndockPrivilege 2092 wmic.exe Token: SeManageVolumePrivilege 2092 wmic.exe Token: 33 2092 wmic.exe Token: 34 2092 wmic.exe Token: 35 2092 wmic.exe Token: SeIncreaseQuotaPrivilege 2092 wmic.exe Token: SeSecurityPrivilege 2092 wmic.exe Token: SeTakeOwnershipPrivilege 2092 wmic.exe Token: SeLoadDriverPrivilege 2092 wmic.exe Token: SeSystemProfilePrivilege 2092 wmic.exe Token: SeSystemtimePrivilege 2092 wmic.exe Token: SeProfSingleProcessPrivilege 2092 wmic.exe Token: SeIncBasePriorityPrivilege 2092 wmic.exe Token: SeCreatePagefilePrivilege 2092 wmic.exe Token: SeBackupPrivilege 2092 wmic.exe Token: SeRestorePrivilege 2092 wmic.exe Token: SeShutdownPrivilege 2092 wmic.exe Token: SeDebugPrivilege 2092 wmic.exe Token: SeSystemEnvironmentPrivilege 2092 wmic.exe Token: SeRemoteShutdownPrivilege 2092 wmic.exe Token: SeUndockPrivilege 2092 wmic.exe Token: SeManageVolumePrivilege 2092 wmic.exe Token: 33 2092 wmic.exe Token: 34 2092 wmic.exe Token: 35 2092 wmic.exe Token: SeIncreaseQuotaPrivilege 2168 wmic.exe Token: SeSecurityPrivilege 2168 wmic.exe Token: SeTakeOwnershipPrivilege 2168 wmic.exe Token: SeLoadDriverPrivilege 2168 wmic.exe Token: SeSystemProfilePrivilege 2168 wmic.exe Token: SeSystemtimePrivilege 2168 wmic.exe Token: SeProfSingleProcessPrivilege 2168 wmic.exe Token: SeIncBasePriorityPrivilege 2168 wmic.exe Token: SeCreatePagefilePrivilege 2168 wmic.exe Token: SeBackupPrivilege 2168 wmic.exe Token: SeRestorePrivilege 2168 wmic.exe Token: SeShutdownPrivilege 2168 wmic.exe Token: SeDebugPrivilege 2168 wmic.exe Token: SeSystemEnvironmentPrivilege 2168 wmic.exe Token: SeRemoteShutdownPrivilege 2168 wmic.exe Token: SeUndockPrivilege 2168 wmic.exe Token: SeManageVolumePrivilege 2168 wmic.exe Token: 33 2168 wmic.exe Token: 34 2168 wmic.exe Token: 35 2168 wmic.exe Token: SeIncreaseQuotaPrivilege 2112 wmic.exe Token: SeSecurityPrivilege 2112 wmic.exe Token: SeTakeOwnershipPrivilege 2112 wmic.exe Token: SeLoadDriverPrivilege 2112 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2268 2396 setup.exe 30 PID 2396 wrote to memory of 2268 2396 setup.exe 30 PID 2396 wrote to memory of 2268 2396 setup.exe 30 PID 2396 wrote to memory of 2268 2396 setup.exe 30 PID 2268 wrote to memory of 2092 2268 begcabjfeh.exe 31 PID 2268 wrote to memory of 2092 2268 begcabjfeh.exe 31 PID 2268 wrote to memory of 2092 2268 begcabjfeh.exe 31 PID 2268 wrote to memory of 2092 2268 begcabjfeh.exe 31 PID 2268 wrote to memory of 2168 2268 begcabjfeh.exe 34 PID 2268 wrote to memory of 2168 2268 begcabjfeh.exe 34 PID 2268 wrote to memory of 2168 2268 begcabjfeh.exe 34 PID 2268 wrote to memory of 2168 2268 begcabjfeh.exe 34 PID 2268 wrote to memory of 2112 2268 begcabjfeh.exe 36 PID 2268 wrote to memory of 2112 2268 begcabjfeh.exe 36 PID 2268 wrote to memory of 2112 2268 begcabjfeh.exe 36 PID 2268 wrote to memory of 2112 2268 begcabjfeh.exe 36 PID 2268 wrote to memory of 2820 2268 begcabjfeh.exe 38 PID 2268 wrote to memory of 2820 2268 begcabjfeh.exe 38 PID 2268 wrote to memory of 2820 2268 begcabjfeh.exe 38 PID 2268 wrote to memory of 2820 2268 begcabjfeh.exe 38 PID 2268 wrote to memory of 2592 2268 begcabjfeh.exe 40 PID 2268 wrote to memory of 2592 2268 begcabjfeh.exe 40 PID 2268 wrote to memory of 2592 2268 begcabjfeh.exe 40 PID 2268 wrote to memory of 2592 2268 begcabjfeh.exe 40 PID 2268 wrote to memory of 2756 2268 begcabjfeh.exe 42 PID 2268 wrote to memory of 2756 2268 begcabjfeh.exe 42 PID 2268 wrote to memory of 2756 2268 begcabjfeh.exe 42 PID 2268 wrote to memory of 2756 2268 begcabjfeh.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\begcabjfeh.exeC:\Users\Admin\AppData\Local\Temp\begcabjfeh.exe 0#2#7#5#6#9#9#0#8#5#0 L05CPzcpKjEvMiAvUU49SkA7PSgbL05DTVJJSUJJPDgwIC09RE1LQEQ1KyAvQUI/NycXL0hNT0RTPE9ZQDs9KBsvU0NLUT9JVlVKRz1ocm1rNCYmc2pxLkRDTEYnS0ZQJTxQUCxCSUBGFy87R0lDSUI/NxcmRCk4LTEeKD8sNCQxGCpEMzsmLBomOzQ1KDEgLT0wNyQoICdLUk9CTj5OVkdSQVFBQ1c2GylHSU88UENUXT5QRjg0ICdLUk9CTj5OVkVBRUA9IC0+Uz9WTFJEOCAvQ1FAWTpERERETkU7GSpCRkpUVz1ST1VMQEw0JyAnT0hBTERUSUxWVUpHPSAtT0g3KRcvPE4xPR4oTU9FS0lFQF9XQ0U+SUQ8SUU8R0VTS0c3FyZJS1pSVUxNREc8NHRqcGUgLUtATkxJTkFJR19TTEBMVjtBUU49Mh4oQ0M7PFg1LCAvR0xaPlBFQUVEQ19DRz5MUEdUPT89Zl9lbl8XJkRHUk5MTTo/WUBHPSkvNi4vMS8oJyUxKTAgL046TTtDQ0VEWklOUU08RkM0dGpwZSAtTURHPDQxLDEyMDMxMDAnFy88SldOSkg8PlZLSUVAPTQtLCspKScxLiUxMTgrLTQrJypISA==2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81727470276.txt bios get serialnumber3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81727470276.txt bios get version3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81727470276.txt bios get version3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81727470276.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:2820
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81727470276.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:2592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:2756
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
572KB
MD56bf07399c81bdbc7b2eb15593d16682a
SHA16ce1a75917f90fd296b6f223f3d770c44c3dedad
SHA256d7994191f8acb48b335346017afa50687e75dab488a4b2e344c1e00a15542e14
SHA512e382ba3f6445a22cb578c7cf97087d8bd14bfd3de38e6d34fba9a9caf1662656e09d20a8c83d485cc999bda840ae907534deb501288fccf361eca9a7f3cc706c