Analysis
-
max time kernel
62s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18/08/2021, 03:07
Static task
static1
Behavioral task
behavioral1
Sample
RunSomeAware.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
RunSomeAware.exe
-
Size
11KB
-
MD5
defb1faf5a77b823116112dac2e084e2
-
SHA1
423a42138ef0244d18c5502d3af26650521295ed
-
SHA256
df5991f1866b6ba4ca5e6dd81ff50bd4857df9d8eea740850e9abc0f42e15fcd
-
SHA512
5143190d851abe515ebc30e7ac8c096e9a39c9d53de776f950929ac56f8f83bb2147690ba15464558469b4978e3a701031485a588847c27d46d2f44619da2aab
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\7-Zip\Lang\[email protected] RunSomeAware.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[email protected] RunSomeAware.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\[email protected] RunSomeAware.exe File created C:\Program Files\7-Zip\Lang\[email protected] RunSomeAware.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\[email protected] RunSomeAware.exe File created C:\Program Files\VideoLAN\VLC\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\[email protected] RunSomeAware.exe File created C:\Program Files\7-Zip\Lang\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jre7\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.pagar40br@gmail.com RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\[email protected] RunSomeAware.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] RunSomeAware.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\[email protected] RunSomeAware.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\[email protected] RunSomeAware.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\[email protected] RunSomeAware.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\[email protected] RunSomeAware.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1084 RunSomeAware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RunSomeAware.exe"C:\Users\Admin\AppData\Local\Temp\RunSomeAware.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Urgent Notice.txt1⤵PID:536