Analysis
- max time kernel
69s - max time network
125s - platform
windows10_x64 - resource
win10v20210410 - submitted
06/07/2021, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
da08fd5cc12c1d7d906c6151a93057aa.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
da08fd5cc12c1d7d906c6151a93057aa.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target da08fd5cc12c1d7d906c6151a93057aa.exe
- Size 975KB
- Sample210706-l4e7exkkps
- SHA256 e82473f02711056cbcda98d22a858d95c6cf574c17ee77ea62db86e405ff6e77
- MD5 da08fd5cc12c1d7d906c6151a93057aa
- SHA1 fd269e07c0baced682bee5fa67f185f40d63ff54
- SHA512 9c2e9a107f76b54fc6e7529817ea5ef4637a27407a6938500dda50c44a514f58074bd94bf873cd46ee4bba4a5adb65f1f649adc99a796fadba61898243932371
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" da08fd5cc12c1d7d906c6151a93057aa.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3904 set thread context of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 - Drops file in Program Files directory 55 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Temp\GUM1CBD.tmp\GOFB2B~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe da08fd5cc12c1d7d906c6151a93057aa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe da08fd5cc12c1d7d906c6151a93057aa.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com da08fd5cc12c1d7d906c6151a93057aa.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" da08fd5cc12c1d7d906c6151a93057aa.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 3904 da08fd5cc12c1d7d906c6151a93057aa.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3904 da08fd5cc12c1d7d906c6151a93057aa.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3904 wrote to memory of 2628 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 79 PID 3904 wrote to memory of 2628 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 79 PID 3904 wrote to memory of 2628 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 79 PID 3904 wrote to memory of 2720 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 80 PID 3904 wrote to memory of 2720 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 80 PID 3904 wrote to memory of 2720 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 80 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81 PID 3904 wrote to memory of 3364 3904 da08fd5cc12c1d7d906c6151a93057aa.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"2⤵PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"2⤵PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"C:\Users\Admin\AppData\Local\Temp\da08fd5cc12c1d7d906c6151a93057aa.exe"2⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:3364
-