Overview

overview

10

Static

static

7fc9d4a00d...84.exe

windows7_x64

10

7fc9d4a00d...84.exe

windows10_x64

7

Analysis

  • max time kernel
    21s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    17-03-2021 12:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe

  • Size

    2.0MB

  • MD5

    602c4fc857abdc65397927df41fc638d

  • SHA1

    57dd28ad57e53751dbf68959a5a8fc4012d905a4

  • SHA256

    7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84

  • SHA512

    c7da5aff57e4c125a4b42bf6a7e319509b9786fd673f4e3320ed0e2124cdf649ac4708ed2430bc7f550e2ba260383cf2a1099d0b4f9ac7ec6af3516c815d84ad

Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe
    "C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:700
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c timeout 4
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3792
      • C:\Windows\SysWOW64\timeout.exe
        timeout 4
        3⤵
        • Delays execution with timeout.exe
        PID:3452
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3992
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:728
    • C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe
      "C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe"
      2⤵
        PID:1912
      • C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe
        "C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe"
        2⤵
          PID:1540
        • C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe
          "C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe"
          2⤵
            PID:1536
          • C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe
            "C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe"
            2⤵
              PID:1112
            • C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe
              "C:\Users\Admin\AppData\Local\Temp\7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84.exe"
              2⤵
                PID:1220
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 1188
                  3⤵
                  • Program crash
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3396
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1492
                2⤵
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3940

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Persistence

            Privilege Escalation

            Defense Evasion

            Credential Access

            Credentials in Files

            2
            T1081

            Discovery

            Query Registry

            1
            T1012

            System Information Discovery

            1
            T1082

            Lateral Movement

            Collection

            Data from Local System

            2
            T1005

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/700-3-0x0000000000D70000-0x0000000000D71000-memory.dmp
              Filesize

              4KB

              Download
            • memory/700-4-0x0000000005D80000-0x0000000005D81000-memory.dmp
              Filesize

              4KB

              Download
            • memory/700-5-0x0000000005920000-0x0000000005921000-memory.dmp
              Filesize

              4KB

              Download
            • memory/700-2-0x0000000073920000-0x000000007400E000-memory.dmp
              Filesize

              6.9MB

              Download
            • memory/700-13-0x0000000007C70000-0x0000000007C71000-memory.dmp
              Filesize

              4KB

              Download
            • memory/700-8-0x00000000053A0000-0x00000000053E7000-memory.dmp
              Filesize

              284KB

              Download
            • memory/728-10-0x0000000000000000-mapping.dmp
              Download
            • memory/1220-14-0x0000000000400000-0x000000000043B000-memory.dmp
              Filesize

              236KB

              Download
            • memory/1220-11-0x0000000000400000-0x000000000043B000-memory.dmp
              Filesize

              236KB

              Download
            • memory/1220-12-0x000000000041EBF2-mapping.dmp
              Download
            • memory/3396-18-0x0000000004940000-0x0000000004941000-memory.dmp
              Filesize

              4KB

              Download
            • memory/3396-21-0x0000000004D40000-0x0000000004D41000-memory.dmp
              Filesize

              4KB

              Download
            • memory/3452-7-0x0000000000000000-mapping.dmp
              Download
            • memory/3792-6-0x0000000000000000-mapping.dmp
              Download
            • memory/3940-15-0x0000000004360000-0x0000000004361000-memory.dmp
              Filesize

              4KB

              Download
            • memory/3992-9-0x0000000000000000-mapping.dmp
              Download