Analysis
-
max time kernel
19s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
05/05/2020, 05:42
Static task
static1
Behavioral task
behavioral1
Sample
main.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
main.exe
-
Size
2.2MB
-
MD5
b22a50ab027d620c4db5fae365758edc
-
SHA1
95bd1d0c6470ee66ae5cde36863001b98560d15f
-
SHA256
528417986548a34850cc83042c6963fd6a19adcdb00158579e6f32c9fce7cade
-
SHA512
957b09adb88d6ce74d08936b0d452b7c791cc372ceba7cf38ecae57fbed74fac768cfb691d7f6b74bcb9ec8c7f146abdf5b6dd63bcab41f57a1d7d3c8dc3c345
Score
7/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2376 wrote to memory of 504 2376 main.exe 67 PID 2376 wrote to memory of 504 2376 main.exe 67 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 504 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 504 powershell.exe 504 powershell.exe 504 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2376 main.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 52 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini main.exe File created C:\Users\Admin\Saved Games\desktop.ini main.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini main.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini main.exe File created C:\Users\Admin\Desktop\desktop.ini main.exe File created C:\Users\Admin\Favorites\Links\desktop.ini main.exe File created C:\Users\Admin\Documents\desktop.ini main.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini main.exe File created C:\Users\Admin\OneDrive\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini main.exe File created C:\Users\Admin\Music\desktop.ini main.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini main.exe File created C:\Users\Admin\Downloads\desktop.ini main.exe File created C:\Users\Admin\Videos\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini main.exe File created C:\Users\Admin\Searches\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini main.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini main.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini main.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini main.exe File created C:\Users\Admin\Favorites\desktop.ini main.exe File created C:\Users\Admin\Pictures\desktop.ini main.exe File created C:\Users\Admin\Contacts\desktop.ini main.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini main.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini main.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: RenamesItself
- Drops desktop.ini file(s)
- Drops startup file
PID:2376 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell [Environment]::GetLogicalDrives()2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:504
-