Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
24-10-2021 03:07
Static task
static1
Behavioral task
behavioral1
Sample
askinstall59.exe
Resource
win7-en-20210920
0 signatures
0 seconds
General
-
Target
askinstall59.exe
-
Size
1.4MB
-
MD5
91fc5a9d9ddf6868e41cba2eb0e8e92d
-
SHA1
5bf358a41876254760650518cee379b1ad0c17d5
-
SHA256
5876c046abaa28048e204be22470eeb20cbd975c25191a0ac8a5edd844a58aa0
-
SHA512
d23f8687b4dbaa941b3cf954b63f141e7fc94ce5d362c9fd0ce8da03e049a14d803db61eb69c3da1db368623e6f79f2b7a02fab8316ec2b0693292642e9b6da1
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1972 taskkill.exe -
Processes:
askinstall59.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 askinstall59.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde askinstall59.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
askinstall59.exetaskkill.exedescription pid process Token: SeCreateTokenPrivilege 476 askinstall59.exe Token: SeAssignPrimaryTokenPrivilege 476 askinstall59.exe Token: SeLockMemoryPrivilege 476 askinstall59.exe Token: SeIncreaseQuotaPrivilege 476 askinstall59.exe Token: SeMachineAccountPrivilege 476 askinstall59.exe Token: SeTcbPrivilege 476 askinstall59.exe Token: SeSecurityPrivilege 476 askinstall59.exe Token: SeTakeOwnershipPrivilege 476 askinstall59.exe Token: SeLoadDriverPrivilege 476 askinstall59.exe Token: SeSystemProfilePrivilege 476 askinstall59.exe Token: SeSystemtimePrivilege 476 askinstall59.exe Token: SeProfSingleProcessPrivilege 476 askinstall59.exe Token: SeIncBasePriorityPrivilege 476 askinstall59.exe Token: SeCreatePagefilePrivilege 476 askinstall59.exe Token: SeCreatePermanentPrivilege 476 askinstall59.exe Token: SeBackupPrivilege 476 askinstall59.exe Token: SeRestorePrivilege 476 askinstall59.exe Token: SeShutdownPrivilege 476 askinstall59.exe Token: SeDebugPrivilege 476 askinstall59.exe Token: SeAuditPrivilege 476 askinstall59.exe Token: SeSystemEnvironmentPrivilege 476 askinstall59.exe Token: SeChangeNotifyPrivilege 476 askinstall59.exe Token: SeRemoteShutdownPrivilege 476 askinstall59.exe Token: SeUndockPrivilege 476 askinstall59.exe Token: SeSyncAgentPrivilege 476 askinstall59.exe Token: SeEnableDelegationPrivilege 476 askinstall59.exe Token: SeManageVolumePrivilege 476 askinstall59.exe Token: SeImpersonatePrivilege 476 askinstall59.exe Token: SeCreateGlobalPrivilege 476 askinstall59.exe Token: 31 476 askinstall59.exe Token: 32 476 askinstall59.exe Token: 33 476 askinstall59.exe Token: 34 476 askinstall59.exe Token: 35 476 askinstall59.exe Token: SeDebugPrivilege 1972 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
askinstall59.execmd.exedescription pid process target process PID 476 wrote to memory of 1012 476 askinstall59.exe cmd.exe PID 476 wrote to memory of 1012 476 askinstall59.exe cmd.exe PID 476 wrote to memory of 1012 476 askinstall59.exe cmd.exe PID 476 wrote to memory of 1012 476 askinstall59.exe cmd.exe PID 1012 wrote to memory of 1972 1012 cmd.exe taskkill.exe PID 1012 wrote to memory of 1972 1012 cmd.exe taskkill.exe PID 1012 wrote to memory of 1972 1012 cmd.exe taskkill.exe PID 1012 wrote to memory of 1972 1012 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\askinstall59.exe"C:\Users\Admin\AppData\Local\Temp\askinstall59.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken