Analysis
-
max time kernel
154s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
25-11-2021 12:32
Static task
static1
Behavioral task
behavioral1
Sample
d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe
-
Size
6.3MB
-
MD5
d8f03daa4389b4e6ce37a3d3664e74f5
-
SHA1
9f044353923afec678d50777e8dc2e18a4b5ce21
-
SHA256
d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6
-
SHA512
4ea37e044be69b88c53f7bdecd0eb5c431fc3f112bd1cfd53942463756cd3187a3a5a2ead9a4ea82f6fc323213a17b9231d6ce9493f68cfe71aac250121a99f9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2728 syncapp.exe -
Loads dropped DLL 12 IoCs
pid Process 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe 1204 MsiExec.exe 1204 MsiExec.exe 3536 MsiExec.exe 3536 MsiExec.exe 3536 MsiExec.exe 3536 MsiExec.exe 3536 MsiExec.exe 3536 MsiExec.exe 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe 2728 syncapp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\O: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\W: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\U: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\V: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\N: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\Y: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\Z: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\K: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\Q: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\R: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\S: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\L: d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSICE6C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID228.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIDBD0.tmp msiexec.exe File created C:\Windows\Installer\f75caf2.msi msiexec.exe File opened for modification C:\Windows\Installer\f75caf2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID45C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID596.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{41FE8904-EAB3-489E-ADD8-A651DB615D1E} msiexec.exe File opened for modification C:\Windows\Installer\MSICFF4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID2C5.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 syncapp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString syncapp.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3452 msiexec.exe 3452 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3452 msiexec.exe Token: SeCreateTokenPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeAssignPrimaryTokenPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeLockMemoryPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeIncreaseQuotaPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeMachineAccountPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeTcbPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeSecurityPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeTakeOwnershipPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeLoadDriverPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeSystemProfilePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeSystemtimePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeProfSingleProcessPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeIncBasePriorityPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeCreatePagefilePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeCreatePermanentPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeBackupPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeRestorePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeShutdownPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeDebugPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeAuditPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeSystemEnvironmentPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeChangeNotifyPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeRemoteShutdownPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeUndockPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeSyncAgentPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeEnableDelegationPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeManageVolumePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeImpersonatePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeCreateGlobalPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeCreateTokenPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeAssignPrimaryTokenPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeLockMemoryPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeIncreaseQuotaPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeMachineAccountPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeTcbPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeSecurityPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeTakeOwnershipPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeLoadDriverPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeSystemProfilePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeSystemtimePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeProfSingleProcessPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeIncBasePriorityPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeCreatePagefilePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeCreatePermanentPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeBackupPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeRestorePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeShutdownPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeDebugPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeAuditPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeSystemEnvironmentPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeChangeNotifyPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeRemoteShutdownPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeUndockPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeSyncAgentPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeEnableDelegationPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeManageVolumePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeImpersonatePrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeCreateGlobalPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeCreateTokenPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeAssignPrimaryTokenPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeLockMemoryPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeIncreaseQuotaPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe Token: SeMachineAccountPrivilege 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2804 msiexec.exe 2804 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3452 wrote to memory of 1204 3452 msiexec.exe 71 PID 3452 wrote to memory of 1204 3452 msiexec.exe 71 PID 3452 wrote to memory of 1204 3452 msiexec.exe 71 PID 2904 wrote to memory of 2804 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe 72 PID 2904 wrote to memory of 2804 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe 72 PID 2904 wrote to memory of 2804 2904 d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe 72 PID 3452 wrote to memory of 3536 3452 msiexec.exe 73 PID 3452 wrote to memory of 3536 3452 msiexec.exe 73 PID 3452 wrote to memory of 3536 3452 msiexec.exe 73 PID 3452 wrote to memory of 2728 3452 msiexec.exe 74 PID 3452 wrote to memory of 2728 3452 msiexec.exe 74 PID 3452 wrote to memory of 2728 3452 msiexec.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe"C:\Users\Admin\AppData\Local\Temp\d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Fieldston Software\Extended Voul Painter 3.2.1.6\install\B615D1E\adv2.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636075031 " AI_EUIMSI=""2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2804
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 925A455FB71F539D6E2CFAF82C126A2B C2⤵
- Loads dropped DLL
PID:1204
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4EF86AC7B38A9E28F2F2ADEEBA3DD2982⤵
- Loads dropped DLL
PID:3536
-
-
C:\Users\Admin\AppData\Roaming\Fieldston Software\Extended Voul Painter\syncapp.exe"C:\Users\Admin\AppData\Roaming\Fieldston Software\Extended Voul Painter\syncapp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2728
-