Analysis
- max time kernel
25s - max time network
135s - platform
windows10_x64 - resource
win10v20210410 - submitted
23/06/2021, 23:52
Static task
static1
Behavioral task
behavioral1
Sample
6348584e7297e257afe64e59efbfe223.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6348584e7297e257afe64e59efbfe223.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 6348584e7297e257afe64e59efbfe223.exe
- Size 3.7MB
- Sample210623-4x772epkas
- SHA256 6f03fba6702cb99f1b9b45f60dbfd9d52e3d5ce019bcf4e68d91dbf54592c236
- MD5 6348584e7297e257afe64e59efbfe223
- SHA1 b510d334a364e524fd9b4daaa4c878255339242a
- SHA512 9423e84f800ffd8b0b5292815318432663b76fc78dc5f65ad4ede1075536ab89d41482bcfbbdeb8812343fe9d599a64a1a7eb2828f9c9c1da57a39933b9d23e6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 6348584e7297e257afe64e59efbfe223.exe - Executes dropped EXE 1 IoCs
pid Process 1772 6348584e7297e257afe64e59efbfe223.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 55 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Google\Temp\GUM1CBD.tmp\GOFB2B~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 6348584e7297e257afe64e59efbfe223.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 6348584e7297e257afe64e59efbfe223.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 6348584e7297e257afe64e59efbfe223.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 6348584e7297e257afe64e59efbfe223.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1772 6348584e7297e257afe64e59efbfe223.exe 1772 6348584e7297e257afe64e59efbfe223.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1772 1808 6348584e7297e257afe64e59efbfe223.exe 75 PID 1808 wrote to memory of 1772 1808 6348584e7297e257afe64e59efbfe223.exe 75 PID 1808 wrote to memory of 1772 1808 6348584e7297e257afe64e59efbfe223.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\6348584e7297e257afe64e59efbfe223.exe"C:\Users\Admin\AppData\Local\Temp\6348584e7297e257afe64e59efbfe223.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6348584e7297e257afe64e59efbfe223.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\6348584e7297e257afe64e59efbfe223.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1772
-