7ac85caab1bd1edc1cbefe16fe41f33db07506d91b5a655640dc2b28eb660b27

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-en-20211208
submitted
02/01/2022, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60b68e2925c28a98093f155f3a0504dd.exe
Size 396KB
Sample220102-cdafkagegq
SHA256 7ac85caab1bd1edc1cbefe16fe41f33db07506d91b5a655640dc2b28eb660b27
MD5 60b68e2925c28a98093f155f3a0504dd
SHA1 df2e703a20ed054c37e76a88eaa17cd7ddde53c2
SHA512 f1af91dc8412bbffa63b611383e43da2bc3ba94890065af4d197d18db0b222faeceb99424ab8b4890cc67f3cf84cc765bfb0732fbe927f8c9ce01174c047873e
MD5 SHA1 SHA512

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2036	Eyxzvkdgdjwsjyukadyxmdriversecond.exe

Loads dropped DLL 6 IoCs

pid	Process
832	WScript.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1220 set thread context of 676	1220	60b68e2925c28a98093f155f3a0504dd.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	2036	WerFault.exe	28

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	60b68e2925c28a98093f155f3a0504dd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	60b68e2925c28a98093f155f3a0504dd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	60b68e2925c28a98093f155f3a0504dd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Eyxzvkdgdjwsjyukadyxmdriversecond.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Eyxzvkdgdjwsjyukadyxmdriversecond.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1220	60b68e2925c28a98093f155f3a0504dd.exe
1220	60b68e2925c28a98093f155f3a0504dd.exe
1220	60b68e2925c28a98093f155f3a0504dd.exe
1220	60b68e2925c28a98093f155f3a0504dd.exe
1220	60b68e2925c28a98093f155f3a0504dd.exe
1220	60b68e2925c28a98093f155f3a0504dd.exe
676	60b68e2925c28a98093f155f3a0504dd.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	60b68e2925c28a98093f155f3a0504dd.exe
Token: SeDebugPrivilege	2036	Eyxzvkdgdjwsjyukadyxmdriversecond.exe
Token: SeDebugPrivilege	676	60b68e2925c28a98093f155f3a0504dd.exe
Token: SeDebugPrivilege	1924	WerFault.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 832	1220	60b68e2925c28a98093f155f3a0504dd.exe	27
PID 1220 wrote to memory of 832	1220	60b68e2925c28a98093f155f3a0504dd.exe	27
PID 1220 wrote to memory of 832	1220	60b68e2925c28a98093f155f3a0504dd.exe	27
PID 1220 wrote to memory of 832	1220	60b68e2925c28a98093f155f3a0504dd.exe	27
PID 832 wrote to memory of 2036	832	WScript.exe	28
PID 832 wrote to memory of 2036	832	WScript.exe	28
PID 832 wrote to memory of 2036	832	WScript.exe	28
PID 832 wrote to memory of 2036	832	WScript.exe	28
PID 1220 wrote to memory of 1832	1220	60b68e2925c28a98093f155f3a0504dd.exe	29
PID 1220 wrote to memory of 1832	1220	60b68e2925c28a98093f155f3a0504dd.exe	29
PID 1220 wrote to memory of 1832	1220	60b68e2925c28a98093f155f3a0504dd.exe	29
PID 1220 wrote to memory of 1832	1220	60b68e2925c28a98093f155f3a0504dd.exe	29
PID 1220 wrote to memory of 676	1220	60b68e2925c28a98093f155f3a0504dd.exe	30
PID 1220 wrote to memory of 676	1220	60b68e2925c28a98093f155f3a0504dd.exe	30
PID 1220 wrote to memory of 676	1220	60b68e2925c28a98093f155f3a0504dd.exe	30
PID 1220 wrote to memory of 676	1220	60b68e2925c28a98093f155f3a0504dd.exe	30
PID 1220 wrote to memory of 676	1220	60b68e2925c28a98093f155f3a0504dd.exe	30
PID 1220 wrote to memory of 676	1220	60b68e2925c28a98093f155f3a0504dd.exe	30
PID 1220 wrote to memory of 676	1220	60b68e2925c28a98093f155f3a0504dd.exe	30
PID 1220 wrote to memory of 676	1220	60b68e2925c28a98093f155f3a0504dd.exe	30
PID 1220 wrote to memory of 676	1220	60b68e2925c28a98093f155f3a0504dd.exe	30
PID 2036 wrote to memory of 1924	2036	Eyxzvkdgdjwsjyukadyxmdriversecond.exe	32
PID 2036 wrote to memory of 1924	2036	Eyxzvkdgdjwsjyukadyxmdriversecond.exe	32
PID 2036 wrote to memory of 1924	2036	Eyxzvkdgdjwsjyukadyxmdriversecond.exe	32
PID 2036 wrote to memory of 1924	2036	Eyxzvkdgdjwsjyukadyxmdriversecond.exe	32

C:\Users\Admin\AppData\Local\Temp\60b68e2925c28a98093f155f3a0504dd.exe
"C:\Users\Admin\AppData\Local\Temp\60b68e2925c28a98093f155f3a0504dd.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Wowsmowxozuvqqawpvv.vbs"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Users\Admin\AppData\Local\Temp\Eyxzvkdgdjwsjyukadyxmdriversecond.exe
    "C:\Users\Admin\AppData\Local\Temp\Eyxzvkdgdjwsjyukadyxmdriversecond.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 1532
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1924
- C:\Users\Admin\AppData\Local\Temp\60b68e2925c28a98093f155f3a0504dd.exe
  C:\Users\Admin\AppData\Local\Temp\60b68e2925c28a98093f155f3a0504dd.exe
  2⤵
  PID:1832
- C:\Users\Admin\AppData\Local\Temp\60b68e2925c28a98093f155f3a0504dd.exe
  C:\Users\Admin\AppData\Local\Temp\60b68e2925c28a98093f155f3a0504dd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-69-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/676-73-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/676-78-0x0000000000450000-0x0000000000451000-memory.dmp

Download

memory/676-77-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/676-75-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/676-70-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/676-71-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/676-72-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1220-54-0x0000000000D20000-0x0000000000D88000-memory.dmp

Download

memory/1220-60-0x00000000041C0000-0x00000000041DC000-memory.dmp

Download

memory/1220-58-0x00000000049C0000-0x0000000004A32000-memory.dmp

Download

memory/1220-57-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Download

memory/1220-56-0x0000000076C61000-0x0000000076C63000-memory.dmp

Download

memory/1220-55-0x0000000000D20000-0x0000000000D88000-memory.dmp

Download

memory/1924-85-0x00000000002C0000-0x0000000000320000-memory.dmp

Download

memory/2036-76-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/2036-68-0x0000000000350000-0x00000000003B8000-memory.dmp

Download

memory/2036-67-0x0000000000350000-0x00000000003B8000-memory.dmp

Download