Analysis
- max time kernel
119s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/03/2022, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
a4d6a3e2aeeccbe61c6a08277202a6c8.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
General
- Target a4d6a3e2aeeccbe61c6a08277202a6c8.exe
- Size 1.4MB
- Sample220308-m45phaeaa4
- SHA256 30848ef37385f4ac651b57894d64c3876f449fc6c891b8633699533331a339b6
- MD5 a4d6a3e2aeeccbe61c6a08277202a6c8
- SHA1 900efed3e80646ab8b79bb7e27f3da19f3740c56
- SHA512 db658b7810834d4ea412b9d0e2c5a923c0e60eb787f8210774bc091b62dee912e8165f33ba002e80566e684f6d0de27ac12d7634dc94655ec0439154ab7282f1
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
pid Process 1032 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e a4d6a3e2aeeccbe61c6a08277202a6c8.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeAssignPrimaryTokenPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeLockMemoryPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeIncreaseQuotaPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeMachineAccountPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeTcbPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeSecurityPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeTakeOwnershipPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeLoadDriverPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeSystemProfilePrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeSystemtimePrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeProfSingleProcessPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeIncBasePriorityPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeCreatePagefilePrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeCreatePermanentPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeBackupPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeRestorePrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeShutdownPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeDebugPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeAuditPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeSystemEnvironmentPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeChangeNotifyPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeRemoteShutdownPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeUndockPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeSyncAgentPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeEnableDelegationPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeManageVolumePrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeImpersonatePrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeCreateGlobalPrivilege 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: 31 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: 32 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: 33 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: 34 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: 35 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe Token: SeDebugPrivilege 1032 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1492 wrote to memory of 3180 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe 82 PID 1492 wrote to memory of 3180 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe 82 PID 1492 wrote to memory of 3180 1492 a4d6a3e2aeeccbe61c6a08277202a6c8.exe 82 PID 3180 wrote to memory of 1032 3180 cmd.exe 84 PID 3180 wrote to memory of 1032 3180 cmd.exe 84 PID 3180 wrote to memory of 1032 3180 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4d6a3e2aeeccbe61c6a08277202a6c8.exe"C:\Users\Admin\AppData\Local\Temp\a4d6a3e2aeeccbe61c6a08277202a6c8.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-