Analysis
-
max time kernel
117s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25/12/2021, 08:10
Static task
static1
Behavioral task
behavioral1
Sample
7594faafcbda5e8cd083b9a58e2c6b78.exe
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
7594faafcbda5e8cd083b9a58e2c6b78.exe
-
Size
1.4MB
-
MD5
7594faafcbda5e8cd083b9a58e2c6b78
-
SHA1
9cb399dab50eed65800c22c4a86e3831ba163446
-
SHA256
0d5fad1de85eef9a74cade2bbe9e236a9d76cfbaf67ff11de080c4323b2534ec
-
SHA512
c7ae0a73b8a2746f747296b78efbc7ee275f3800f986738bded80557ec933c0b04699248b9c4694ee1a89c5969ede55d579dfe6ba0b30bc1b6a4b60b38075291
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 4084 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeAssignPrimaryTokenPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeLockMemoryPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeIncreaseQuotaPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeMachineAccountPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeTcbPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeSecurityPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeTakeOwnershipPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeLoadDriverPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeSystemProfilePrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeSystemtimePrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeProfSingleProcessPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeIncBasePriorityPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeCreatePagefilePrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeCreatePermanentPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeBackupPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeRestorePrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeShutdownPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeDebugPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeAuditPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeSystemEnvironmentPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeChangeNotifyPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeRemoteShutdownPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeUndockPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeSyncAgentPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeEnableDelegationPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeManageVolumePrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeImpersonatePrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeCreateGlobalPrivilege 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: 31 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: 32 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: 33 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: 34 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: 35 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe Token: SeDebugPrivilege 4084 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3532 wrote to memory of 2484 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe 69 PID 3532 wrote to memory of 2484 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe 69 PID 3532 wrote to memory of 2484 3532 7594faafcbda5e8cd083b9a58e2c6b78.exe 69 PID 2484 wrote to memory of 4084 2484 cmd.exe 71 PID 2484 wrote to memory of 4084 2484 cmd.exe 71 PID 2484 wrote to memory of 4084 2484 cmd.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\7594faafcbda5e8cd083b9a58e2c6b78.exe"C:\Users\Admin\AppData\Local\Temp\7594faafcbda5e8cd083b9a58e2c6b78.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-