Analysis
- max time kernel
49s - max time network
113s - platform
windows7_x64 - resource
win7-20220331-en - submitted
12/04/2022, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
9bb281af432af3b64f5fbe1026262164.exe
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
- Target 9bb281af432af3b64f5fbe1026262164.exe
- Size 1.4MB
- Sample220412-pgldfseea6
- SHA256 36adfea999715f71e99f4ee0160421ae30bc4500682f673fd7ef1ea4a8fb640d
- MD5 9bb281af432af3b64f5fbe1026262164
- SHA1 7c29954deb7d50a395923997aa770da2f9f8a6b5
- SHA512 62c6d9fa843221f4b79d0bafd85e3751f1245d7f189553e8ccddd90bf2da55d2a744cb090f62e6db1da38c182d8300f5dae54c6f6cf9cac1b774a25adf0c67cb
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
pid Process 568 taskkill.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 9bb281af432af3b64f5fbe1026262164.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 9bb281af432af3b64f5fbe1026262164.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 9bb281af432af3b64f5fbe1026262164.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeAssignPrimaryTokenPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeLockMemoryPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeIncreaseQuotaPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeMachineAccountPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeTcbPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeSecurityPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeTakeOwnershipPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeLoadDriverPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeSystemProfilePrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeSystemtimePrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeProfSingleProcessPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeIncBasePriorityPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeCreatePagefilePrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeCreatePermanentPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeBackupPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeRestorePrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeShutdownPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeDebugPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeAuditPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeSystemEnvironmentPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeChangeNotifyPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeRemoteShutdownPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeUndockPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeSyncAgentPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeEnableDelegationPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeManageVolumePrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeImpersonatePrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeCreateGlobalPrivilege 1500 9bb281af432af3b64f5fbe1026262164.exe Token: 31 1500 9bb281af432af3b64f5fbe1026262164.exe Token: 32 1500 9bb281af432af3b64f5fbe1026262164.exe Token: 33 1500 9bb281af432af3b64f5fbe1026262164.exe Token: 34 1500 9bb281af432af3b64f5fbe1026262164.exe Token: 35 1500 9bb281af432af3b64f5fbe1026262164.exe Token: SeDebugPrivilege 568 taskkill.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1500 wrote to memory of 996 1500 9bb281af432af3b64f5fbe1026262164.exe 29 PID 1500 wrote to memory of 996 1500 9bb281af432af3b64f5fbe1026262164.exe 29 PID 1500 wrote to memory of 996 1500 9bb281af432af3b64f5fbe1026262164.exe 29 PID 1500 wrote to memory of 996 1500 9bb281af432af3b64f5fbe1026262164.exe 29 PID 996 wrote to memory of 568 996 cmd.exe 31 PID 996 wrote to memory of 568 996 cmd.exe 31 PID 996 wrote to memory of 568 996 cmd.exe 31 PID 996 wrote to memory of 568 996 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bb281af432af3b64f5fbe1026262164.exe"C:\Users\Admin\AppData\Local\Temp\9bb281af432af3b64f5fbe1026262164.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:568
-
-