Analysis
- max time kernel
73s - max time network
53s - platform
windows7_x64 - resource
win7v20210410 - submitted
06/07/2021, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
da08fd5cc12c1d7d906c6151a93057aa.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
da08fd5cc12c1d7d906c6151a93057aa.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target da08fd5cc12c1d7d906c6151a93057aa.exe
- Size 975KB
- Sample210706-l4e7exkkps
- SHA256 e82473f02711056cbcda98d22a858d95c6cf574c17ee77ea62db86e405ff6e77
- MD5 da08fd5cc12c1d7d906c6151a93057aa
- SHA1 fd269e07c0baced682bee5fa67f185f40d63ff54
- SHA512 9c2e9a107f76b54fc6e7529817ea5ef4637a27407a6938500dda50c44a514f58074bd94bf873cd46ee4bba4a5adb65f1f649adc99a796fadba61898243932371
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" da08fd5cc12c1d7d906c6151a93057aa.exe - Loads dropped DLL 3 IoCs
pid Process 740 da08fd5cc12c1d7d906c6151a93057aa.exe 740 da08fd5cc12c1d7d906c6151a93057aa.exe 740 da08fd5cc12c1d7d906c6151a93057aa.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1216 set thread context of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Temp\GUME011.tmp\GOFB2B~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE da08fd5cc12c1d7d906c6151a93057aa.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com da08fd5cc12c1d7d906c6151a93057aa.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" da08fd5cc12c1d7d906c6151a93057aa.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29 PID 1216 wrote to memory of 740 1216 da08fd5cc12c1d7d906c6151a93057aa.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"2⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:740
-