Analysis
- max time kernel
121s - max time network
124s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
07/10/2021, 19:43
Static task
static1
Behavioral task
behavioral1
Sample
2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe
- Size 260KB
- Sample211007-ye8weadahp
- SHA256 2ce7ad2edfed9bf00a5df059bc2e83d4e5570765d1ce3b512926a32ba458b1b6
- MD5 ad72f25aec117b60b5d23494f56435b4
- SHA1 698af8f489fde90f1c6a81b1779df3e2ebb36e6e
- SHA512 8698b14490c1d284ef5886cca2603afddca4566ac3d2e60a0ad9cb7bcc3cbf42ca3879d3f375757290bebe214cea28058cccaeccb625ac1aca2346fcb2b42136
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
pony
C2
-
http://superiorbroomproducers.com/opjis/UD099/gate.php
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 2504 1720 WerFault.exe 69 - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeImpersonatePrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeTcbPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeChangeNotifyPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeCreateTokenPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeBackupPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeRestorePrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeIncreaseQuotaPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeAssignPrimaryTokenPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeImpersonatePrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeTcbPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeChangeNotifyPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeCreateTokenPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeBackupPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeRestorePrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeIncreaseQuotaPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeAssignPrimaryTokenPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeImpersonatePrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeTcbPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeChangeNotifyPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeCreateTokenPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeBackupPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeRestorePrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeIncreaseQuotaPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeAssignPrimaryTokenPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeImpersonatePrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeTcbPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeChangeNotifyPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeCreateTokenPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeBackupPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeRestorePrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeIncreaseQuotaPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeAssignPrimaryTokenPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeImpersonatePrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeTcbPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeChangeNotifyPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeCreateTokenPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeBackupPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeRestorePrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeIncreaseQuotaPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeAssignPrimaryTokenPrivilege 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe Token: SeRestorePrivilege 2504 WerFault.exe Token: SeBackupPrivilege 2504 WerFault.exe Token: SeDebugPrivilege 2504 WerFault.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1720 wrote to memory of 3076 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe 72 PID 1720 wrote to memory of 3076 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe 72 PID 1720 wrote to memory of 3076 1720 2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe"C:\Users\Admin\AppData\Local\Temp\2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 15522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259377937.bat" "C:\Users\Admin\AppData\Local\Temp\2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe" "2⤵PID:3076
-