Analysis
- max time kernel
153s - max time network
138s - platform
windows10_x64 - resource
win10v20210408 - submitted
30/09/2021, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe
- Size 409KB
- Sample210930-pfhk6shfc2
- SHA256 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d
- MD5 d891bae31afba4a67b81e54907dfc682
- SHA1 ddd1b5f964d50fe72e20211c9fd4e227d2569aca
- SHA512 755b1eeb09caf593446b0a3da1e9ba9f4850c1866b07ff99b23e02226d6d415e52b0329f91624adc52e3f7e2f6cca3c66de2a5d4c3f4f010ab64cece7fb322a0
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 9 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\b4ef7d823731fe9240e8e00f66182c6e\Admin@GFBFPSXA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File opened for modification C:\Users\Admin\AppData\Local\b4ef7d823731fe9240e8e00f66182c6e\Admin@GFBFPSXA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\b4ef7d823731fe9240e8e00f66182c6e\Admin@GFBFPSXA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\b4ef7d823731fe9240e8e00f66182c6e\Admin@GFBFPSXA_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\b4ef7d823731fe9240e8e00f66182c6e\Admin@GFBFPSXA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\b4ef7d823731fe9240e8e00f66182c6e\Admin@GFBFPSXA_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File opened for modification C:\Users\Admin\AppData\Local\b4ef7d823731fe9240e8e00f66182c6e\Admin@GFBFPSXA_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\b4ef7d823731fe9240e8e00f66182c6e\Admin@GFBFPSXA_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe File created C:\Users\Admin\AppData\Local\b4ef7d823731fe9240e8e00f66182c6e\Admin@GFBFPSXA_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 icanhazip.com - Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4016 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe Token: SeDebugPrivilege 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 604 wrote to memory of 600 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 68 PID 604 wrote to memory of 600 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 68 PID 604 wrote to memory of 600 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 68 PID 600 wrote to memory of 4004 600 cmd.exe 70 PID 600 wrote to memory of 4004 600 cmd.exe 70 PID 600 wrote to memory of 4004 600 cmd.exe 70 PID 600 wrote to memory of 708 600 cmd.exe 71 PID 600 wrote to memory of 708 600 cmd.exe 71 PID 600 wrote to memory of 708 600 cmd.exe 71 PID 600 wrote to memory of 3096 600 cmd.exe 72 PID 600 wrote to memory of 3096 600 cmd.exe 72 PID 600 wrote to memory of 3096 600 cmd.exe 72 PID 604 wrote to memory of 3176 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 73 PID 604 wrote to memory of 3176 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 73 PID 604 wrote to memory of 3176 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 73 PID 3176 wrote to memory of 768 3176 cmd.exe 75 PID 3176 wrote to memory of 768 3176 cmd.exe 75 PID 3176 wrote to memory of 768 3176 cmd.exe 75 PID 3176 wrote to memory of 3580 3176 cmd.exe 76 PID 3176 wrote to memory of 3580 3176 cmd.exe 76 PID 3176 wrote to memory of 3580 3176 cmd.exe 76 PID 604 wrote to memory of 4016 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 79 PID 604 wrote to memory of 4016 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 79 PID 604 wrote to memory of 4016 604 703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe"C:\Users\Admin\AppData\Local\Temp\703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe"1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:4004
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:708
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:3096
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:768
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:3580
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Local\Temp\703cebeff04a0cbadeb1772d129f68a4c998f8b3f36e0c1ef9d343df0a90949d.exe"2⤵
- Creates scheduled task(s)
PID:4016
-