Analysis
-
max time kernel
4294180s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
07-03-2022 20:43
Static task
static1
Behavioral task
behavioral1
Sample
Main__Setup.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
Main__Setup.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
P@ssWorD is= 1234.jpg
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
P@ssWorD is= 1234.jpg
Resource
win10v2004-en-20220113
General
-
Target
Main__Setup.exe
-
Size
750.0MB
-
MD5
0acc6b030f96957830f7b9dc92023a12
-
SHA1
86fc468e5d074433e84ed450f5d5bb78b1f17011
-
SHA256
6efa533a39cda08148230e64ead2ee1b48418891fb69bd2fe87a53abee37ff71
-
SHA512
ffd44734269fcdb2408cd3f90afb73bd642162831b1c19b0f13bd6be0d5796ebadd9d94166be2bfa2e64417d450f1d96609cee2b3407a767fff47bfe49543cf9
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1656-66-0x0000000000400000-0x0000000000547000-memory.dmp autoit_exe behavioral1/memory/1656-68-0x0000000000400000-0x0000000000547000-memory.dmp autoit_exe behavioral1/memory/1656-70-0x0000000000400000-0x0000000000547000-memory.dmp autoit_exe behavioral1/memory/1656-72-0x0000000000400000-0x0000000000547000-memory.dmp autoit_exe behavioral1/memory/1656-75-0x0000000000400000-0x0000000000547000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Main__Setup.exedescription pid process target process PID 1100 set thread context of 1656 1100 Main__Setup.exe Main__Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
Processes:
Main__Setup.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2 Main__Setup.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
Processes:
Main__Setup.exeMain__Setup.exepid process 1100 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe 1656 Main__Setup.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Main__Setup.exedescription pid process Token: SeDebugPrivilege 1100 Main__Setup.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Main__Setup.exepid process 1656 Main__Setup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Main__Setup.exeMain__Setup.exedescription pid process target process PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1100 wrote to memory of 1656 1100 Main__Setup.exe Main__Setup.exe PID 1656 wrote to memory of 824 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 824 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 824 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 824 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1960 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1960 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1960 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1960 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 668 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 668 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 668 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 668 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 916 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 916 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 916 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 916 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 548 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 548 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 548 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 548 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1116 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1116 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1116 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1116 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1080 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1080 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1080 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1080 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 2004 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 2004 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 2004 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 2004 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1524 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1524 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1524 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1524 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 912 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 912 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 912 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 912 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1724 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1724 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1724 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1724 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1944 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1944 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1944 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1944 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1612 1656 Main__Setup.exe cmd.exe PID 1656 wrote to memory of 1612 1656 Main__Setup.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Main__Setup.exe"C:\Users\Admin\AppData\Local\Temp\Main__Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Main__Setup.exeC:\Users\Admin\AppData\Local\Temp\Main__Setup.exe2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\Desktop\*.txt" "C:\Users\Admin\AppData\Local\Temp\3109\_Files"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "C:\Users\Admin\wallet.dat" /S /B /A-D3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "C:\Users\Admin\UTC--2*" /S /B /A-D3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Web Data" "C:\Users\Admin\AppData\Local\Temp\3109\_Chrome\default_webdata.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\3109\_Chrome\default_logins.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Cookies" "C:\Users\Admin\AppData\Local\Temp\3109\_Chrome\default_cookies.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\google\chrome\User Data\Default\Network\Cookies" "C:\Users\Admin\AppData\Local\Temp\3109\_Chrome\default_cookies.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\formhistory.sqlite" "C:\Users\Admin\AppData\Local\Temp\3109\_Firefox\formhistory.sqlite"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\cookies.sqlite" "C:\Users\Admin\AppData\Local\Temp\3109\_Firefox\cookies.sqlite"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\signons.sqlite" "C:\Users\Admin\AppData\Local\Temp\3109\_Firefox\signons.sqlite"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\logins.json" "C:\Users\Admin\AppData\Local\Temp\3109\_Firefox\logins.json"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\key3.db" "C:\Users\Admin\AppData\Local\Temp\3109\_Firefox\key3.db"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /Y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles/faxxuvis.Admin\key4.db" "C:\Users\Admin\AppData\Local\Temp\3109\_Firefox\key4.db"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3109\_Chrome\default_cookies.dbMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\3109\_Chrome\default_logins.dbMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\3109\_Chrome\default_webdata.dbMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
memory/1100-54-0x0000000000B60000-0x0000000000BCA000-memory.dmpFilesize
424KB
-
memory/1100-55-0x0000000074AD0000-0x00000000751BE000-memory.dmpFilesize
6.9MB
-
memory/1100-56-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/1100-57-0x00000000062A0000-0x00000000063BC000-memory.dmpFilesize
1.1MB
-
memory/1100-58-0x0000000005BD0000-0x0000000005CC8000-memory.dmpFilesize
992KB
-
memory/1100-59-0x00000000051B0000-0x00000000051FC000-memory.dmpFilesize
304KB
-
memory/1656-68-0x0000000000400000-0x0000000000547000-memory.dmpFilesize
1.3MB
-
memory/1656-77-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1656-70-0x0000000000400000-0x0000000000547000-memory.dmpFilesize
1.3MB
-
memory/1656-72-0x0000000000400000-0x0000000000547000-memory.dmpFilesize
1.3MB
-
memory/1656-74-0x0000000076A01000-0x0000000076A03000-memory.dmpFilesize
8KB
-
memory/1656-75-0x0000000000400000-0x0000000000547000-memory.dmpFilesize
1.3MB
-
memory/1656-76-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1656-66-0x0000000000400000-0x0000000000547000-memory.dmpFilesize
1.3MB
-
memory/1656-78-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1656-79-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1656-64-0x0000000000400000-0x0000000000547000-memory.dmpFilesize
1.3MB
-
memory/1656-62-0x0000000000400000-0x0000000000547000-memory.dmpFilesize
1.3MB
-
memory/1656-60-0x0000000000400000-0x0000000000547000-memory.dmpFilesize
1.3MB
-
memory/1656-83-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB