Analysis
- max time kernel
51s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
09/08/2021, 13:25
Static task
static1
Behavioral task
behavioral1
Sample
0941a59548b4f95082dfa17f85c6557c.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0941a59548b4f95082dfa17f85c6557c.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 0941a59548b4f95082dfa17f85c6557c.exe
- Size 1.3MB
- Sample210809-4mvexhlvbe
- SHA256 b2beeab94f7cbc38143e2a050c263476419bb48d2ec37470df5b1ee0da812f50
- MD5 0941a59548b4f95082dfa17f85c6557c
- SHA1 d6edc9316356ee3748e3de70d3d59dcb95b34de2
- SHA512 f2d06f72fbb8dc090b019d012bfe6759a194f7eeb0620f8e0082566f05d206856ec0459a2ac520a11b74d5d4cc87105128d0f86f5583180bdc3f53ec55436450
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0941a59548b4f95082dfa17f85c6557c.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs
- Executes dropped EXE 2 IoCs
pid Process 2044 0941a59548b4f95082dfa17f85c6557c.exe 3880 svchost.com - Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0941a59548b4f95082dfa17f85c6557c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0941a59548b4f95082dfa17f85c6557c.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Uses the VBS compiler for execution 1 TTPs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 0941a59548b4f95082dfa17f85c6557c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 0941a59548b4f95082dfa17f85c6557c.exe - Drops file in Program Files directory 55 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Google\Temp\GUM18A1.tmp\GOFB2B~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 0941a59548b4f95082dfa17f85c6557c.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 0941a59548b4f95082dfa17f85c6557c.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1528 schtasks.exe - Modifies registry class 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0941a59548b4f95082dfa17f85c6557c.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings 0941a59548b4f95082dfa17f85c6557c.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2044 0941a59548b4f95082dfa17f85c6557c.exe 2044 0941a59548b4f95082dfa17f85c6557c.exe 2044 0941a59548b4f95082dfa17f85c6557c.exe 2044 0941a59548b4f95082dfa17f85c6557c.exe 2044 0941a59548b4f95082dfa17f85c6557c.exe 2044 0941a59548b4f95082dfa17f85c6557c.exe 2044 0941a59548b4f95082dfa17f85c6557c.exe 2044 0941a59548b4f95082dfa17f85c6557c.exe 2044 0941a59548b4f95082dfa17f85c6557c.exe 2044 0941a59548b4f95082dfa17f85c6557c.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2044 0941a59548b4f95082dfa17f85c6557c.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 580 wrote to memory of 2044 580 0941a59548b4f95082dfa17f85c6557c.exe 75 PID 580 wrote to memory of 2044 580 0941a59548b4f95082dfa17f85c6557c.exe 75 PID 580 wrote to memory of 2044 580 0941a59548b4f95082dfa17f85c6557c.exe 75 PID 2044 wrote to memory of 3880 2044 0941a59548b4f95082dfa17f85c6557c.exe 79 PID 2044 wrote to memory of 3880 2044 0941a59548b4f95082dfa17f85c6557c.exe 79 PID 2044 wrote to memory of 3880 2044 0941a59548b4f95082dfa17f85c6557c.exe 79 PID 3880 wrote to memory of 1528 3880 svchost.com 80 PID 3880 wrote to memory of 1528 3880 svchost.com 80 PID 3880 wrote to memory of 1528 3880 svchost.com 80 PID 2044 wrote to memory of 1752 2044 0941a59548b4f95082dfa17f85c6557c.exe 81 PID 2044 wrote to memory of 1752 2044 0941a59548b4f95082dfa17f85c6557c.exe 81 PID 2044 wrote to memory of 1752 2044 0941a59548b4f95082dfa17f85c6557c.exe 81 PID 2044 wrote to memory of 2212 2044 0941a59548b4f95082dfa17f85c6557c.exe 83 PID 2044 wrote to memory of 2212 2044 0941a59548b4f95082dfa17f85c6557c.exe 83 PID 2044 wrote to memory of 2212 2044 0941a59548b4f95082dfa17f85c6557c.exe 83 PID 2044 wrote to memory of 2484 2044 0941a59548b4f95082dfa17f85c6557c.exe 84 PID 2044 wrote to memory of 2484 2044 0941a59548b4f95082dfa17f85c6557c.exe 84 PID 2044 wrote to memory of 2484 2044 0941a59548b4f95082dfa17f85c6557c.exe 84 PID 2044 wrote to memory of 2540 2044 0941a59548b4f95082dfa17f85c6557c.exe 86 PID 2044 wrote to memory of 2540 2044 0941a59548b4f95082dfa17f85c6557c.exe 86 PID 2044 wrote to memory of 2540 2044 0941a59548b4f95082dfa17f85c6557c.exe 86 PID 2044 wrote to memory of 2664 2044 0941a59548b4f95082dfa17f85c6557c.exe 85 PID 2044 wrote to memory of 2664 2044 0941a59548b4f95082dfa17f85c6557c.exe 85 PID 2044 wrote to memory of 2664 2044 0941a59548b4f95082dfa17f85c6557c.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\0941a59548b4f95082dfa17f85c6557c.exe"C:\Users\Admin\AppData\Local\Temp\0941a59548b4f95082dfa17f85c6557c.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0941a59548b4f95082dfa17f85c6557c.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\0941a59548b4f95082dfa17f85c6557c.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TfIdAJRB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3D39.tmp"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /Create /TN Updates\TfIdAJRB /XML C:\Users\Admin\AppData\Local\Temp\tmp3D39.tmp4⤵
- Creates scheduled task(s)
PID:1528
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:1752
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:2212
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:2484
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:2664
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:2540
-
-