Analysis
- max time kernel
147s - max time network
151s - platform
windows10_x64 - resource
win10-20220310-en - submitted
21/03/2022, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
TokenGrabber.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TokenGrabber.exe
Resource
win10-20220310-en
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
TokenGrabber.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target TokenGrabber.exe
- Size 61KB
- Sample220321-l4n63sbbe4
- SHA256 f181d1bd3c75b62fb470d51189ccab6bce8d589df2408129b8ebf6edc96bdb35
- MD5 b42d629df5d3568b1be1ab3f9fbda48f
- SHA1 3e8dbeccf3fa46879c65384fef574db83b58f0d0
- SHA512 0f0d59097e91b35a40891cc14975c27c8229ad9ec7620f92865668fa71bdbd1f3363241404f740479088bc5c7b1321f185b1e2eac1c8de9b0402798bc131e525
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
- Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\SendResize.tiff.givemenitro TokenGrabber.exe File opened for modification C:\Users\Admin\Pictures\SendResize.tiff TokenGrabber.exe File created C:\Users\Admin\Pictures\UnlockDisable.crw.givemenitro TokenGrabber.exe File created C:\Users\Admin\Pictures\DisconnectLock.tif.givemenitro TokenGrabber.exe File created C:\Users\Admin\Pictures\EnableDisable.crw.givemenitro TokenGrabber.exe File created C:\Users\Admin\Pictures\InitializeCompress.raw.givemenitro TokenGrabber.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TokenGrabber.exe\"" TokenGrabber.exe - Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini TokenGrabber.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini TokenGrabber.exe File opened for modification C:\Users\Admin\Documents\desktop.ini TokenGrabber.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini TokenGrabber.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini TokenGrabber.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 3 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" TokenGrabber.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2716 TokenGrabber.exe 2716 TokenGrabber.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2716 TokenGrabber.exe Token: SeIncreaseQuotaPrivilege 2252 WMIC.exe Token: SeSecurityPrivilege 2252 WMIC.exe Token: SeTakeOwnershipPrivilege 2252 WMIC.exe Token: SeLoadDriverPrivilege 2252 WMIC.exe Token: SeSystemProfilePrivilege 2252 WMIC.exe Token: SeSystemtimePrivilege 2252 WMIC.exe Token: SeProfSingleProcessPrivilege 2252 WMIC.exe Token: SeIncBasePriorityPrivilege 2252 WMIC.exe Token: SeCreatePagefilePrivilege 2252 WMIC.exe Token: SeBackupPrivilege 2252 WMIC.exe Token: SeRestorePrivilege 2252 WMIC.exe Token: SeShutdownPrivilege 2252 WMIC.exe Token: SeDebugPrivilege 2252 WMIC.exe Token: SeSystemEnvironmentPrivilege 2252 WMIC.exe Token: SeRemoteShutdownPrivilege 2252 WMIC.exe Token: SeUndockPrivilege 2252 WMIC.exe Token: SeManageVolumePrivilege 2252 WMIC.exe Token: 33 2252 WMIC.exe Token: 34 2252 WMIC.exe Token: 35 2252 WMIC.exe Token: 36 2252 WMIC.exe Token: SeIncreaseQuotaPrivilege 2252 WMIC.exe Token: SeSecurityPrivilege 2252 WMIC.exe Token: SeTakeOwnershipPrivilege 2252 WMIC.exe Token: SeLoadDriverPrivilege 2252 WMIC.exe Token: SeSystemProfilePrivilege 2252 WMIC.exe Token: SeSystemtimePrivilege 2252 WMIC.exe Token: SeProfSingleProcessPrivilege 2252 WMIC.exe Token: SeIncBasePriorityPrivilege 2252 WMIC.exe Token: SeCreatePagefilePrivilege 2252 WMIC.exe Token: SeBackupPrivilege 2252 WMIC.exe Token: SeRestorePrivilege 2252 WMIC.exe Token: SeShutdownPrivilege 2252 WMIC.exe Token: SeDebugPrivilege 2252 WMIC.exe Token: SeSystemEnvironmentPrivilege 2252 WMIC.exe Token: SeRemoteShutdownPrivilege 2252 WMIC.exe Token: SeUndockPrivilege 2252 WMIC.exe Token: SeManageVolumePrivilege 2252 WMIC.exe Token: 33 2252 WMIC.exe Token: 34 2252 WMIC.exe Token: 35 2252 WMIC.exe Token: 36 2252 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2716 wrote to memory of 3628 2716 TokenGrabber.exe 69 PID 2716 wrote to memory of 3628 2716 TokenGrabber.exe 69 PID 2716 wrote to memory of 3628 2716 TokenGrabber.exe 69 PID 3628 wrote to memory of 2252 3628 cmd.exe 71 PID 3628 wrote to memory of 2252 3628 cmd.exe 71 PID 3628 wrote to memory of 2252 3628 cmd.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\TokenGrabber.exe"C:\Users\Admin\AppData\Local\Temp\TokenGrabber.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-