Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
21/11/2021, 15:55
Static task
static1
Behavioral task
behavioral1
Sample
6ed15ba1793b318e075928be2009a1f1.exe
Resource
win7-en-20211104
General
-
Target
6ed15ba1793b318e075928be2009a1f1.exe
-
Size
1.7MB
-
MD5
6ed15ba1793b318e075928be2009a1f1
-
SHA1
01b2bf94f9e3c971cc20d73940c46f0854fd5412
-
SHA256
96da16f1b813f61ded62562735c22429b4a38ab5f42281afe16ae87e92abbf1b
-
SHA512
9158780264be1549c53b344a79a34f6dcc233b651078c4e9133b663c9965fbe6ca143fc6c9ccabb12703596d4fd89e314cf9db4d69b0997f3dff0b165a1abd90
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1180 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeAssignPrimaryTokenPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeLockMemoryPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeIncreaseQuotaPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeMachineAccountPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeTcbPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeSecurityPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeTakeOwnershipPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeLoadDriverPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeSystemProfilePrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeSystemtimePrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeProfSingleProcessPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeIncBasePriorityPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeCreatePagefilePrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeCreatePermanentPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeBackupPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeRestorePrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeShutdownPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeDebugPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeAuditPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeSystemEnvironmentPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeChangeNotifyPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeRemoteShutdownPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeUndockPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeSyncAgentPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeEnableDelegationPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeManageVolumePrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeImpersonatePrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeCreateGlobalPrivilege 756 6ed15ba1793b318e075928be2009a1f1.exe Token: 31 756 6ed15ba1793b318e075928be2009a1f1.exe Token: 32 756 6ed15ba1793b318e075928be2009a1f1.exe Token: 33 756 6ed15ba1793b318e075928be2009a1f1.exe Token: 34 756 6ed15ba1793b318e075928be2009a1f1.exe Token: 35 756 6ed15ba1793b318e075928be2009a1f1.exe Token: SeDebugPrivilege 1180 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 756 wrote to memory of 724 756 6ed15ba1793b318e075928be2009a1f1.exe 29 PID 756 wrote to memory of 724 756 6ed15ba1793b318e075928be2009a1f1.exe 29 PID 756 wrote to memory of 724 756 6ed15ba1793b318e075928be2009a1f1.exe 29 PID 756 wrote to memory of 724 756 6ed15ba1793b318e075928be2009a1f1.exe 29 PID 724 wrote to memory of 1180 724 cmd.exe 31 PID 724 wrote to memory of 1180 724 cmd.exe 31 PID 724 wrote to memory of 1180 724 cmd.exe 31 PID 724 wrote to memory of 1180 724 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ed15ba1793b318e075928be2009a1f1.exe"C:\Users\Admin\AppData\Local\Temp\6ed15ba1793b318e075928be2009a1f1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-