Analysis
-
max time kernel
116s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
24-10-2021 00:31
Static task
static1
Behavioral task
behavioral1
Sample
b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe
Resource
win7-en-20211014
General
-
Target
b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe
-
Size
1.4MB
-
MD5
b29ad6358b274a95ec3ed237591b5302
-
SHA1
c39c4e63757a2bda8e542b6d52fe450d4658c3bd
-
SHA256
b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4
-
SHA512
9aada5aaaaca2fda3857b77b1d81f731cd49be053ae92771913044b4da772bcf8fa82c495cade22699dd1e0e17235c77e248ce90455fa9a627b32a196152adad
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2372 taskkill.exe -
Processes:
b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exetaskkill.exedescription pid process Token: SeCreateTokenPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeAssignPrimaryTokenPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeLockMemoryPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeIncreaseQuotaPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeMachineAccountPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeTcbPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeSecurityPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeTakeOwnershipPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeLoadDriverPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeSystemProfilePrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeSystemtimePrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeProfSingleProcessPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeIncBasePriorityPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeCreatePagefilePrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeCreatePermanentPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeBackupPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeRestorePrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeShutdownPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeDebugPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeAuditPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeSystemEnvironmentPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeChangeNotifyPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeRemoteShutdownPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeUndockPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeSyncAgentPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeEnableDelegationPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeManageVolumePrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeImpersonatePrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeCreateGlobalPrivilege 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: 31 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: 32 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: 33 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: 34 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: 35 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe Token: SeDebugPrivilege 2372 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.execmd.exedescription pid process target process PID 3284 wrote to memory of 1276 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe cmd.exe PID 3284 wrote to memory of 1276 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe cmd.exe PID 3284 wrote to memory of 1276 3284 b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe cmd.exe PID 1276 wrote to memory of 2372 1276 cmd.exe taskkill.exe PID 1276 wrote to memory of 2372 1276 cmd.exe taskkill.exe PID 1276 wrote to memory of 2372 1276 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe"C:\Users\Admin\AppData\Local\Temp\b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken