950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe
Size

672KB
MD5

6684af5ddae0e1faac8d70180c4d9b70
SHA1

7d85da3ffc446ac16a56221f6cc70facdb657368
SHA256

950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da
SHA512

518df03249009fabc185e0696540b61ff6d1a926539300c9da1f3401987efcd51f69ceb4f4f40e69d506f4d9c31152b35dc68c5d0f2c2ae4051f5e31a2e4ad43
SSDEEP

12288:YyEDqjgIK7FGMUqzjXhX9iU1evbEudwNYsjxiQK1+IPiSu/wOu/WH:KmEV7ZUqn59revbE3Y7QK1+IP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
852	1976	WerFault.exe	22

Runs .reg file with regedit 1 IoCs

pid	Process
1964	regedit.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1964	1976	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	26
PID 1976 wrote to memory of 1964	1976	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	26
PID 1976 wrote to memory of 1964	1976	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	26
PID 1976 wrote to memory of 1964	1976	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	26
PID 1976 wrote to memory of 852	1976	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	27
PID 1976 wrote to memory of 852	1976	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	27
PID 1976 wrote to memory of 852	1976	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	27
PID 1976 wrote to memory of 852	1976	950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe	27

C:\Users\Admin\AppData\Local\Temp\950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe
"C:\Users\Admin\AppData\Local\Temp\950227046eff893851d2181f222191320086400ba042a902b97df527b3e377da.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s C:\Users\Admin\AppData\Local\Temp\\chr_extension_inst.reg
  2⤵
  - Runs .reg file with regedit
  PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 532
  2⤵
  - Program crash
  PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\chr_extension_inst.reg

Filesize
357B

MD5
85994bafd61c8d948cd13194ff774158

SHA1
44ae33e40d0aa91ab6fc04dec6f207af7e24ff64

SHA256
8c6a3aafc42b41dd19a30ad7b4dc8ca1fd941c41f1cc1eba10beff077a59e70b

SHA512
408b30108c41ef1dddbba8585406dea4d72aaef640fb0fec45de14c17fc21c2c651d71f10bccae35b5b4ae1af20d17befedb0ffa5bb48f1de91c186ff14aabc6

Download Submit
memory/1976-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download