Analysis
-
max time kernel
137s -
max time network
138s -
platform
windows7_x64 -
resource
win7-en -
submitted
14-09-2021 09:52
Static task
static1
Behavioral task
behavioral1
Sample
bf4ca3ef810bbc866015723e09cdfb7b.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
bf4ca3ef810bbc866015723e09cdfb7b.exe
Resource
win10-en
General
-
Target
bf4ca3ef810bbc866015723e09cdfb7b.exe
-
Size
476KB
-
MD5
bf4ca3ef810bbc866015723e09cdfb7b
-
SHA1
b1ef1b47cb790ee88866d31bb09929a516e36caf
-
SHA256
70707206bfdc0b86a9494f7780c55829e993a93a7d65d0279bc9c73b97ffc005
-
SHA512
1fdac4d5fc922265871ac741fb3241e28307e6c52297e515e8e5aaeb85c9fb2c88183a3a0f080c4ae9e53e1553064d9308a74b5888b8c42f813e395c09aa45b8
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
bf4ca3ef810bbc866015723e09cdfb7b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" bf4ca3ef810bbc866015723e09cdfb7b.exe -
Loads dropped DLL 3 IoCs
Processes:
bf4ca3ef810bbc866015723e09cdfb7b.exepid process 964 bf4ca3ef810bbc866015723e09cdfb7b.exe 964 bf4ca3ef810bbc866015723e09cdfb7b.exe 964 bf4ca3ef810bbc866015723e09cdfb7b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
bf4ca3ef810bbc866015723e09cdfb7b.exedescription pid process target process PID 820 set thread context of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe -
Drops file in Program Files directory 64 IoCs
Processes:
bf4ca3ef810bbc866015723e09cdfb7b.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Google\Temp\GUMB4FC.tmp\GOFB2B~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE bf4ca3ef810bbc866015723e09cdfb7b.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe bf4ca3ef810bbc866015723e09cdfb7b.exe -
Drops file in Windows directory 1 IoCs
Processes:
bf4ca3ef810bbc866015723e09cdfb7b.exedescription ioc process File opened for modification C:\Windows\svchost.com bf4ca3ef810bbc866015723e09cdfb7b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
bf4ca3ef810bbc866015723e09cdfb7b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" bf4ca3ef810bbc866015723e09cdfb7b.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
bf4ca3ef810bbc866015723e09cdfb7b.exepid process 820 bf4ca3ef810bbc866015723e09cdfb7b.exe 820 bf4ca3ef810bbc866015723e09cdfb7b.exe 820 bf4ca3ef810bbc866015723e09cdfb7b.exe 820 bf4ca3ef810bbc866015723e09cdfb7b.exe 820 bf4ca3ef810bbc866015723e09cdfb7b.exe 820 bf4ca3ef810bbc866015723e09cdfb7b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bf4ca3ef810bbc866015723e09cdfb7b.exedescription pid process Token: SeDebugPrivilege 820 bf4ca3ef810bbc866015723e09cdfb7b.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
bf4ca3ef810bbc866015723e09cdfb7b.exedescription pid process target process PID 820 wrote to memory of 592 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 592 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 592 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 592 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe PID 820 wrote to memory of 964 820 bf4ca3ef810bbc866015723e09cdfb7b.exe bf4ca3ef810bbc866015723e09cdfb7b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe"C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exeC:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exeC:\Users\Admin\AppData\Local\Temp\bf4ca3ef810bbc866015723e09cdfb7b.exe2⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEMD5
9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\PROGRA~2\Google\Temp\GUMB4FC.tmp\GOFB2B~1.EXEMD5
583ff3367e050c4d62bc03516473b40a
SHA16aa1d26352b78310e711884829c35a69ed1bf0f9
SHA2566b63f8dd47d8b3baa71b6cd205d428861b96bf09cf479071e75ddd23f97c0146
SHA512e9bdd5cc2e29db48cc524488fbadb08e808f17f6e18fa595cfebae229c94f2547079e52a2ada214169577b89b2ffbef424729cd90acdea3774f5c76aec192be0
-
\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXEMD5
583ff3367e050c4d62bc03516473b40a
SHA16aa1d26352b78310e711884829c35a69ed1bf0f9
SHA2566b63f8dd47d8b3baa71b6cd205d428861b96bf09cf479071e75ddd23f97c0146
SHA512e9bdd5cc2e29db48cc524488fbadb08e808f17f6e18fa595cfebae229c94f2547079e52a2ada214169577b89b2ffbef424729cd90acdea3774f5c76aec192be0
-
memory/820-53-0x0000000001030000-0x0000000001031000-memory.dmpFilesize
4KB
-
memory/820-55-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/820-56-0x0000000000F90000-0x0000000000FF1000-memory.dmpFilesize
388KB
-
memory/820-61-0x0000000005F00000-0x0000000005F62000-memory.dmpFilesize
392KB
-
memory/964-63-0x00000000004080E4-mapping.dmp
-
memory/964-62-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/964-64-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB
-
memory/964-65-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB