Analysis
- max time kernel
119s - max time network
130s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
12/12/2021, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
a6febf73d79642dbbcae031fb68b9fb6.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target a6febf73d79642dbbcae031fb68b9fb6.exe
- Size 1.4MB
- Sample211212-pbfwsaccd4
- SHA256 df1ae39c8455e74f4c578924e7d96a3bb77317c9d99d2a33ed529b3c65af4789
- MD5 a6febf73d79642dbbcae031fb68b9fb6
- SHA1 806f17ec5f97c8efd3a7a36a1175761a028c1191
- SHA512 2a308500713a2de9a0a31f0212f9ea0b8cc3c25295cba7407444a5ea42930eab1e0c4a109657a3c5c37f0725d589524178e24502d9b67b6a820552db2f9372d3
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
pid Process 2296 taskkill.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeAssignPrimaryTokenPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeLockMemoryPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeIncreaseQuotaPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeMachineAccountPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeTcbPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeSecurityPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeTakeOwnershipPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeLoadDriverPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeSystemProfilePrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeSystemtimePrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeProfSingleProcessPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeIncBasePriorityPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeCreatePagefilePrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeCreatePermanentPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeBackupPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeRestorePrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeShutdownPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeDebugPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeAuditPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeSystemEnvironmentPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeChangeNotifyPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeRemoteShutdownPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeUndockPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeSyncAgentPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeEnableDelegationPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeManageVolumePrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeImpersonatePrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeCreateGlobalPrivilege 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: 31 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: 32 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: 33 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: 34 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: 35 2772 a6febf73d79642dbbcae031fb68b9fb6.exe Token: SeDebugPrivilege 2296 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2772 wrote to memory of 1048 2772 a6febf73d79642dbbcae031fb68b9fb6.exe 69 PID 2772 wrote to memory of 1048 2772 a6febf73d79642dbbcae031fb68b9fb6.exe 69 PID 2772 wrote to memory of 1048 2772 a6febf73d79642dbbcae031fb68b9fb6.exe 69 PID 1048 wrote to memory of 2296 1048 cmd.exe 71 PID 1048 wrote to memory of 2296 1048 cmd.exe 71 PID 1048 wrote to memory of 2296 1048 cmd.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6febf73d79642dbbcae031fb68b9fb6.exe"C:\Users\Admin\AppData\Local\Temp\a6febf73d79642dbbcae031fb68b9fb6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-