Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
21/03/2022, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
TokenGrabber.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TokenGrabber.exe
Resource
win10-20220310-en
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
TokenGrabber.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target TokenGrabber.exe
- Size 61KB
- Sample220321-l4n63sbbe4
- SHA256 f181d1bd3c75b62fb470d51189ccab6bce8d589df2408129b8ebf6edc96bdb35
- MD5 b42d629df5d3568b1be1ab3f9fbda48f
- SHA1 3e8dbeccf3fa46879c65384fef574db83b58f0d0
- SHA512 0f0d59097e91b35a40891cc14975c27c8229ad9ec7620f92865668fa71bdbd1f3363241404f740479088bc5c7b1321f185b1e2eac1c8de9b0402798bc131e525
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
- Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\RemoveTrace.tiff TokenGrabber.exe File created C:\Users\Admin\Pictures\RepairPush.png.givemenitro TokenGrabber.exe File opened for modification C:\Users\Admin\Pictures\ResolveReset.tiff TokenGrabber.exe File created C:\Users\Admin\Pictures\RemoveTrace.tiff.givemenitro TokenGrabber.exe File created C:\Users\Admin\Pictures\LockPush.tif.givemenitro TokenGrabber.exe File created C:\Users\Admin\Pictures\OutUpdate.raw.givemenitro TokenGrabber.exe File created C:\Users\Admin\Pictures\RegisterRestore.png.givemenitro TokenGrabber.exe File created C:\Users\Admin\Pictures\ResolveReset.tiff.givemenitro TokenGrabber.exe File created C:\Users\Admin\Pictures\TraceFind.crw.givemenitro TokenGrabber.exe File created C:\Users\Admin\Pictures\ApproveEnable.tif.givemenitro TokenGrabber.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TokenGrabber.exe\"" TokenGrabber.exe - Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini TokenGrabber.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini TokenGrabber.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini TokenGrabber.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini TokenGrabber.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini TokenGrabber.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.ipify.org 11 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" TokenGrabber.exe - Program crash 2 IoCs
pid pid_target Process procid_target 2592 2400 WerFault.exe 78 1112 2400 WerFault.exe 78 - Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2400 TokenGrabber.exe 2400 TokenGrabber.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2400 TokenGrabber.exe Token: SeIncreaseQuotaPrivilege 3784 WMIC.exe Token: SeSecurityPrivilege 3784 WMIC.exe Token: SeTakeOwnershipPrivilege 3784 WMIC.exe Token: SeLoadDriverPrivilege 3784 WMIC.exe Token: SeSystemProfilePrivilege 3784 WMIC.exe Token: SeSystemtimePrivilege 3784 WMIC.exe Token: SeProfSingleProcessPrivilege 3784 WMIC.exe Token: SeIncBasePriorityPrivilege 3784 WMIC.exe Token: SeCreatePagefilePrivilege 3784 WMIC.exe Token: SeBackupPrivilege 3784 WMIC.exe Token: SeRestorePrivilege 3784 WMIC.exe Token: SeShutdownPrivilege 3784 WMIC.exe Token: SeDebugPrivilege 3784 WMIC.exe Token: SeSystemEnvironmentPrivilege 3784 WMIC.exe Token: SeRemoteShutdownPrivilege 3784 WMIC.exe Token: SeUndockPrivilege 3784 WMIC.exe Token: SeManageVolumePrivilege 3784 WMIC.exe Token: 33 3784 WMIC.exe Token: 34 3784 WMIC.exe Token: 35 3784 WMIC.exe Token: 36 3784 WMIC.exe Token: SeIncreaseQuotaPrivilege 3784 WMIC.exe Token: SeSecurityPrivilege 3784 WMIC.exe Token: SeTakeOwnershipPrivilege 3784 WMIC.exe Token: SeLoadDriverPrivilege 3784 WMIC.exe Token: SeSystemProfilePrivilege 3784 WMIC.exe Token: SeSystemtimePrivilege 3784 WMIC.exe Token: SeProfSingleProcessPrivilege 3784 WMIC.exe Token: SeIncBasePriorityPrivilege 3784 WMIC.exe Token: SeCreatePagefilePrivilege 3784 WMIC.exe Token: SeBackupPrivilege 3784 WMIC.exe Token: SeRestorePrivilege 3784 WMIC.exe Token: SeShutdownPrivilege 3784 WMIC.exe Token: SeDebugPrivilege 3784 WMIC.exe Token: SeSystemEnvironmentPrivilege 3784 WMIC.exe Token: SeRemoteShutdownPrivilege 3784 WMIC.exe Token: SeUndockPrivilege 3784 WMIC.exe Token: SeManageVolumePrivilege 3784 WMIC.exe Token: 33 3784 WMIC.exe Token: 34 3784 WMIC.exe Token: 35 3784 WMIC.exe Token: 36 3784 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2400 wrote to memory of 1348 2400 TokenGrabber.exe 79 PID 2400 wrote to memory of 1348 2400 TokenGrabber.exe 79 PID 2400 wrote to memory of 1348 2400 TokenGrabber.exe 79 PID 1348 wrote to memory of 3784 1348 cmd.exe 81 PID 1348 wrote to memory of 3784 1348 cmd.exe 81 PID 1348 wrote to memory of 3784 1348 cmd.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\TokenGrabber.exe"C:\Users\Admin\AppData\Local\Temp\TokenGrabber.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 10962⤵
- Program crash
PID:2592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 10962⤵
- Program crash
PID:1112
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:3120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2400 -ip 24001⤵PID:2852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2400 -ip 24001⤵PID:1328