Analysis
-
max time kernel
112s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
07-03-2022 19:17
Static task
static1
Behavioral task
behavioral1
Sample
Main__File.exe
Resource
win7-20220223-en
General
-
Target
Main__File.exe
-
Size
3.8MB
-
MD5
1ed83087be2b1284b30649a8da6a684d
-
SHA1
1ac6f1f0e7c9c068105ed97e25cdee72abd029ab
-
SHA256
ac4f3f5419ba904e15370cdaa5999b764e139fe0029d643563503b7c6560b756
-
SHA512
0b18f961a77e1482e30b14a4d1ef63dfcca16dd41db09a47d0b23f9a2217688b50ecc88e3e4281009663c31ec1ec5c1a22b94bdc9398687d8af940230a5aed1d
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Main__File.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Main__File.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Main__File.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/3984-130-0x0000000000700000-0x0000000000FC2000-memory.dmp themida behavioral2/memory/3984-131-0x0000000000700000-0x0000000000FC2000-memory.dmp themida behavioral2/memory/3984-133-0x0000000000700000-0x0000000000FC2000-memory.dmp themida behavioral2/memory/3984-134-0x0000000000700000-0x0000000000FC2000-memory.dmp themida behavioral2/memory/3984-135-0x0000000000700000-0x0000000000FC2000-memory.dmp themida behavioral2/memory/3984-136-0x0000000000700000-0x0000000000FC2000-memory.dmp themida behavioral2/memory/3984-137-0x0000000000700000-0x0000000000FC2000-memory.dmp themida behavioral2/memory/3984-138-0x0000000000700000-0x0000000000FC2000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Main__File.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Main__File.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3984-131-0x0000000000700000-0x0000000000FC2000-memory.dmp autoit_exe behavioral2/memory/3984-133-0x0000000000700000-0x0000000000FC2000-memory.dmp autoit_exe behavioral2/memory/3984-134-0x0000000000700000-0x0000000000FC2000-memory.dmp autoit_exe behavioral2/memory/3984-135-0x0000000000700000-0x0000000000FC2000-memory.dmp autoit_exe behavioral2/memory/3984-136-0x0000000000700000-0x0000000000FC2000-memory.dmp autoit_exe behavioral2/memory/3984-137-0x0000000000700000-0x0000000000FC2000-memory.dmp autoit_exe behavioral2/memory/3984-138-0x0000000000700000-0x0000000000FC2000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Main__File.exepid process 3984 Main__File.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
Processes:
Main__File.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2 Main__File.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Main__File.exepid process 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe 3984 Main__File.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Main__File.exepid process 3984 Main__File.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
Main__File.exedescription pid process target process PID 3984 wrote to memory of 2976 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 2976 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 2976 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3948 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3948 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3948 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1396 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1396 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1396 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 2188 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 2188 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 2188 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3060 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3060 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3060 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1928 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1928 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1928 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1768 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1768 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1768 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3708 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3708 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3708 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1764 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1764 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1764 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3168 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3168 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3168 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1936 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1936 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1936 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3364 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3364 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3364 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3272 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3272 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3272 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3608 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3608 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 3608 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 2584 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 2584 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 2584 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1556 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1556 3984 Main__File.exe cmd.exe PID 3984 wrote to memory of 1556 3984 Main__File.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Main__File.exe"C:\Users\Admin\AppData\Local\Temp\Main__File.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\Desktop\*.txt" "C:\Users\Admin\AppData\Local\Temp\1764\_Files"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "C:\Users\Admin\wallet.dat" /S /B /A-D2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "C:\Users\Admin\UTC--2*" /S /B /A-D2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Web Data" "C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_webdata.db"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_logins.db"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Cookies" "C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_cookies.db"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Network\Cookies" "C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_cookies.db"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "C:\Users\Admin\AppData\Local\Temp\1764\_Edge\default_webdata.db"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\1764\_Edge\default_logins.db"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "C:\Users\Admin\AppData\Local\Temp\1764\_Edge\default_cookies.db"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\formhistory.sqlite" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\formhistory.sqlite"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\cookies.sqlite" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\cookies.sqlite"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\signons.sqlite" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\signons.sqlite"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\logins.json" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\logins.json"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\key3.db" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\key3.db"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/0zrgtpmj.Admin\key4.db" "C:\Users\Admin\AppData\Local\Temp\1764\_Firefox\key4.db"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_cookies.dbMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_logins.dbMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\1764\_Chrome\default_webdata.dbMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
C:\Users\Admin\AppData\Local\Temp\1764\_Edge\default_logins.dbMD5
349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\1764\_Edge\default_webdata.dbMD5
780853cddeaee8de70f28a4b255a600b
SHA1ad7a5da33f7ad12946153c497e990720b09005ed
SHA2561055ff62de3dea7645c732583242adf4164bdcfb9dd37d9b35bbb9510d59b0a3
SHA512e422863112084bb8d11c682482e780cd63c2f20c8e3a93ed3b9efd1b04d53eb5d3c8081851ca89b74d66f3d9ab48eb5f6c74550484f46e7c6e460a8250c9b1d8
-
memory/3984-138-0x0000000000700000-0x0000000000FC2000-memory.dmpFilesize
8.8MB
-
memory/3984-136-0x0000000000700000-0x0000000000FC2000-memory.dmpFilesize
8.8MB
-
memory/3984-137-0x0000000000700000-0x0000000000FC2000-memory.dmpFilesize
8.8MB
-
memory/3984-130-0x0000000000700000-0x0000000000FC2000-memory.dmpFilesize
8.8MB
-
memory/3984-139-0x0000000004160000-0x0000000004161000-memory.dmpFilesize
4KB
-
memory/3984-140-0x0000000005360000-0x0000000005361000-memory.dmpFilesize
4KB
-
memory/3984-141-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/3984-142-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/3984-135-0x0000000000700000-0x0000000000FC2000-memory.dmpFilesize
8.8MB
-
memory/3984-134-0x0000000000700000-0x0000000000FC2000-memory.dmpFilesize
8.8MB
-
memory/3984-132-0x00000000775D0000-0x0000000077773000-memory.dmpFilesize
1.6MB
-
memory/3984-133-0x0000000000700000-0x0000000000FC2000-memory.dmpFilesize
8.8MB
-
memory/3984-131-0x0000000000700000-0x0000000000FC2000-memory.dmpFilesize
8.8MB