Overview
overview
10Static
static
107zS850A099...ed.exe
windows7_x64
107zS850A099...ed.exe
windows10-2004_x64
107zS850A099...1a.exe
windows7_x64
107zS850A099...1a.exe
windows10-2004_x64
17zS850A099...b7.exe
windows7_x64
107zS850A099...b7.exe
windows10-2004_x64
107zS850A099...5e.exe
windows7_x64
107zS850A099...5e.exe
windows10-2004_x64
107zS850A099...a0.exe
windows7_x64
107zS850A099...a0.exe
windows10-2004_x64
107zS850A099...95.exe
windows7_x64
77zS850A099...95.exe
windows10-2004_x64
77zS850A099...cb.exe
windows7_x64
107zS850A099...cb.exe
windows10-2004_x64
17zS850A099...58.exe
windows7_x64
77zS850A099...58.exe
windows10-2004_x64
17zS850A099...7f.exe
windows7_x64
77zS850A099...7f.exe
windows10-2004_x64
17zS850A099...32.exe
windows7_x64
77zS850A099...32.exe
windows10-2004_x64
77zS850A099...c3.exe
windows7_x64
87zS850A099...c3.exe
windows10-2004_x64
87zS850A099...e9.exe
windows7_x64
67zS850A099...e9.exe
windows10-2004_x64
67zS850A099...8c.exe
windows7_x64
87zS850A099...8c.exe
windows10-2004_x64
17zS850A099...8c.exe
windows7_x64
107zS850A099...8c.exe
windows10-2004_x64
107zS850A099...ll.exe
windows7_x64
107zS850A099...ll.exe
windows10-2004_x64
1Analysis
-
max time kernel
129s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
19-01-2022 08:10
Behavioral task
behavioral1
Sample
7zS850A099E/61e74fd2175cb_Tue23956aa60ed.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7zS850A099E/61e74fd2175cb_Tue23956aa60ed.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
7zS850A099E/61e74fd3252fe_Tue23df2ad021a.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
7zS850A099E/61e74fd3252fe_Tue23df2ad021a.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
7zS850A099E/61e74fd41f841_Tue2365aa82b7.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
7zS850A099E/61e74fd41f841_Tue2365aa82b7.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral7
Sample
7zS850A099E/61e74fd53f766_Tue23ec97445e.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
7zS850A099E/61e74fd53f766_Tue23ec97445e.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral9
Sample
7zS850A099E/61e74fd78769f_Tue234b6c24d9a0.exe
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
7zS850A099E/61e74fd78769f_Tue234b6c24d9a0.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral11
Sample
7zS850A099E/61e74fd8ef830_Tue23593425095.exe
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
7zS850A099E/61e74fd8ef830_Tue23593425095.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral13
Sample
7zS850A099E/61e74fda51500_Tue23260baecb.exe
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
7zS850A099E/61e74fda51500_Tue23260baecb.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral15
Sample
7zS850A099E/61e7501ab629f_Tue23c4645058.exe
Resource
win7-en-20211208
Behavioral task
behavioral16
Sample
7zS850A099E/61e7501ab629f_Tue23c4645058.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral17
Sample
7zS850A099E/61e7501b7eabe_Tue2344597f.exe
Resource
win7-en-20211208
Behavioral task
behavioral18
Sample
7zS850A099E/61e7501b7eabe_Tue2344597f.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral19
Sample
7zS850A099E/61e7501c830d6_Tue23bdf4712a32.exe
Resource
win7-en-20211208
Behavioral task
behavioral20
Sample
7zS850A099E/61e7501c830d6_Tue23bdf4712a32.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral21
Sample
7zS850A099E/61e7501db65f3_Tue23c7b395c3.exe
Resource
win7-en-20211208
Behavioral task
behavioral22
Sample
7zS850A099E/61e7501db65f3_Tue23c7b395c3.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral23
Sample
7zS850A099E/61e7502b8389b_Tue233252e9.exe
Resource
win7-en-20211208
Behavioral task
behavioral24
Sample
7zS850A099E/61e7502b8389b_Tue233252e9.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral25
Sample
7zS850A099E/61e7502c4cff3_Tue232cba58c.exe
Resource
win7-en-20211208
Behavioral task
behavioral26
Sample
7zS850A099E/61e7502c4cff3_Tue232cba58c.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral27
Sample
7zS850A099E/61e7502f007f3_Tue23d6fecf8c.exe
Resource
win7-en-20211208
Behavioral task
behavioral28
Sample
7zS850A099E/61e7502f007f3_Tue23d6fecf8c.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral29
Sample
7zS850A099E/setup_install.exe
Resource
win7-en-20211208
Behavioral task
behavioral30
Sample
7zS850A099E/setup_install.exe
Resource
win10v2004-en-20220113
General
-
Target
7zS850A099E/61e74fd78769f_Tue234b6c24d9a0.exe
-
Size
1.4MB
-
MD5
435a69af01a985b95e39fb2016300bb8
-
SHA1
fc4a01fa471de5fcb5199b4dbcba6763a9eedbee
-
SHA256
d5cdd4249fd1b0aae17942ddb359574b4b22ff14736e79960e704b574806a427
-
SHA512
ea21ff6f08535ed0365a98314c71f0ffb87f1e8a03cdc812bbaa36174acc2f820d6d46c13504d9313de831693a3220c622e2ae244ffbcfe9befcbc321422b528
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2720 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
svchost.exe61e74fd78769f_Tue234b6c24d9a0.exetaskkill.exedescription pid process Token: SeSystemtimePrivilege 3956 svchost.exe Token: SeSystemtimePrivilege 3956 svchost.exe Token: SeIncBasePriorityPrivilege 3956 svchost.exe Token: SeCreateTokenPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeAssignPrimaryTokenPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeLockMemoryPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeIncreaseQuotaPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeMachineAccountPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeTcbPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeSecurityPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeTakeOwnershipPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeLoadDriverPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeSystemProfilePrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeSystemtimePrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeProfSingleProcessPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeIncBasePriorityPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeCreatePagefilePrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeCreatePermanentPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeBackupPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeRestorePrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeShutdownPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeDebugPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeAuditPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeSystemEnvironmentPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeChangeNotifyPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeRemoteShutdownPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeUndockPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeSyncAgentPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeEnableDelegationPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeManageVolumePrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeImpersonatePrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeCreateGlobalPrivilege 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: 31 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: 32 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: 33 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: 34 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: 35 3552 61e74fd78769f_Tue234b6c24d9a0.exe Token: SeDebugPrivilege 2720 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
61e74fd78769f_Tue234b6c24d9a0.execmd.exedescription pid process target process PID 3552 wrote to memory of 2932 3552 61e74fd78769f_Tue234b6c24d9a0.exe cmd.exe PID 3552 wrote to memory of 2932 3552 61e74fd78769f_Tue234b6c24d9a0.exe cmd.exe PID 3552 wrote to memory of 2932 3552 61e74fd78769f_Tue234b6c24d9a0.exe cmd.exe PID 2932 wrote to memory of 2720 2932 cmd.exe taskkill.exe PID 2932 wrote to memory of 2720 2932 cmd.exe taskkill.exe PID 2932 wrote to memory of 2720 2932 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e74fd78769f_Tue234b6c24d9a0.exe"C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e74fd78769f_Tue234b6c24d9a0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵
- Suspicious use of AdjustPrivilegeToken