Analysis
-
max time kernel
61s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-06-2021 13:17
Static task
static1
Behavioral task
behavioral1
Sample
askinstall46.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
askinstall46.exe
-
Size
1.4MB
-
MD5
08e02983bf912205efca8487bb62107f
-
SHA1
cfe6e8397409dac32ba08eb3d2d281604f6f3629
-
SHA256
14b59820da7ad7abfb536b1303d7480c459bded64d0444f275a24168f90a4e53
-
SHA512
f2cedecd3076d39e892dae912914f6b122287c94b36d18b98237bddb7f1e8133baf01ab6f96ffd6c4ffb19ab99632f78613a580760ce352de8a69cafa704d716
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid Process 3444 taskkill.exe -
Processes:
askinstall46.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall46.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall46.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
askinstall46.exetaskkill.exedescription pid Process Token: SeCreateTokenPrivilege 3896 askinstall46.exe Token: SeAssignPrimaryTokenPrivilege 3896 askinstall46.exe Token: SeLockMemoryPrivilege 3896 askinstall46.exe Token: SeIncreaseQuotaPrivilege 3896 askinstall46.exe Token: SeMachineAccountPrivilege 3896 askinstall46.exe Token: SeTcbPrivilege 3896 askinstall46.exe Token: SeSecurityPrivilege 3896 askinstall46.exe Token: SeTakeOwnershipPrivilege 3896 askinstall46.exe Token: SeLoadDriverPrivilege 3896 askinstall46.exe Token: SeSystemProfilePrivilege 3896 askinstall46.exe Token: SeSystemtimePrivilege 3896 askinstall46.exe Token: SeProfSingleProcessPrivilege 3896 askinstall46.exe Token: SeIncBasePriorityPrivilege 3896 askinstall46.exe Token: SeCreatePagefilePrivilege 3896 askinstall46.exe Token: SeCreatePermanentPrivilege 3896 askinstall46.exe Token: SeBackupPrivilege 3896 askinstall46.exe Token: SeRestorePrivilege 3896 askinstall46.exe Token: SeShutdownPrivilege 3896 askinstall46.exe Token: SeDebugPrivilege 3896 askinstall46.exe Token: SeAuditPrivilege 3896 askinstall46.exe Token: SeSystemEnvironmentPrivilege 3896 askinstall46.exe Token: SeChangeNotifyPrivilege 3896 askinstall46.exe Token: SeRemoteShutdownPrivilege 3896 askinstall46.exe Token: SeUndockPrivilege 3896 askinstall46.exe Token: SeSyncAgentPrivilege 3896 askinstall46.exe Token: SeEnableDelegationPrivilege 3896 askinstall46.exe Token: SeManageVolumePrivilege 3896 askinstall46.exe Token: SeImpersonatePrivilege 3896 askinstall46.exe Token: SeCreateGlobalPrivilege 3896 askinstall46.exe Token: 31 3896 askinstall46.exe Token: 32 3896 askinstall46.exe Token: 33 3896 askinstall46.exe Token: 34 3896 askinstall46.exe Token: 35 3896 askinstall46.exe Token: SeDebugPrivilege 3444 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
askinstall46.execmd.exedescription pid Process procid_target PID 3896 wrote to memory of 4080 3896 askinstall46.exe 76 PID 3896 wrote to memory of 4080 3896 askinstall46.exe 76 PID 3896 wrote to memory of 4080 3896 askinstall46.exe 76 PID 4080 wrote to memory of 3444 4080 cmd.exe 78 PID 4080 wrote to memory of 3444 4080 cmd.exe 78 PID 4080 wrote to memory of 3444 4080 cmd.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\askinstall46.exe"C:\Users\Admin\AppData\Local\Temp\askinstall46.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3444
-
-