Analysis
- max time kernel
4294217s - max time network
130s - platform
windows7_x64 - resource
win7-20220310-en - submitted
26/03/2022, 01:30
Static task
static1
Behavioral task
behavioral1
Sample
c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe
- Size 536KB
- Sample220326-bwt29abfcl
- SHA256 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2
- MD5 62dd270c7a45183db0a73060993e2583
- SHA1 637555c1d202f54aa2e3bf192217eda00046e0dc
- SHA512 544100d742d3b683d5f3cb012ad05aac08d7bfb3a7fd50928a57cf18b2cf7655c13d191051313c7eae52241cc8aec810bd309ce2f631caeb5a6d8e5b71126efc
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,C:\\Windows\\system32\\winras.exe," c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\winras.exe c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe File created C:\Windows\SysWOW64\winras.exe c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1076 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe"C:\Users\Admin\AppData\Local\Temp\c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076