Analysis
-
max time kernel
151s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2022 22:07
Static task
static1
Behavioral task
behavioral1
Sample
password 2022/1-1.scr
Resource
win7-20220812-en
General
-
Target
password 2022/1-1.scr
-
Size
715.0MB
-
MD5
b0a38f0a315ff80630c62eb81bc5daf0
-
SHA1
0bb1b18b3a144b29b46ca2932ba6a562f9d4b4d8
-
SHA256
c0f743fd14be816dd7c598ea9d61cd84d55d7994c1756e2f752a229106926a0a
-
SHA512
86b30248d9b0d7c53c6888e0dec388e0b38d12fa1a1e93606d7ae90a4f1d2e800da616be76b00559a1d90f21fbe94cc68be3b09f2919201d98c5d4fa17a4d078
-
SSDEEP
24576:+Vo7uE0Oab8xook2OoYQYzzK52QbgWC3yNaarmNZS8hDpAj+5ugpUPiSrcw84obn:wMOYSwiAGVvtTeRdZEHQJfQuB38V+5
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1-1.scrpid process 2220 1-1.scr 2220 1-1.scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1-1.scrdescription pid process Token: SeDebugPrivilege 2220 1-1.scr
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2220-132-0x0000000000970000-0x00000000009AD000-memory.dmpFilesize
244KB
-
memory/2220-133-0x0000000000970000-0x00000000009AD000-memory.dmpFilesize
244KB
-
memory/2220-134-0x000000000D4A0000-0x000000000DAB8000-memory.dmpFilesize
6.1MB
-
memory/2220-135-0x000000000DAC0000-0x000000000DAD2000-memory.dmpFilesize
72KB
-
memory/2220-136-0x000000000DAE0000-0x000000000DBEA000-memory.dmpFilesize
1.0MB
-
memory/2220-137-0x000000000DBF0000-0x000000000DC2C000-memory.dmpFilesize
240KB
-
memory/2220-138-0x000000000DE10000-0x000000000E3B4000-memory.dmpFilesize
5.6MB
-
memory/2220-139-0x000000000E4C0000-0x000000000E552000-memory.dmpFilesize
584KB
-
memory/2220-140-0x000000000E570000-0x000000000E5D6000-memory.dmpFilesize
408KB
-
memory/2220-141-0x000000000E9F0000-0x000000000EA40000-memory.dmpFilesize
320KB
-
memory/2220-142-0x000000000EA50000-0x000000000EAC6000-memory.dmpFilesize
472KB
-
memory/2220-143-0x000000000ECB0000-0x000000000ECCE000-memory.dmpFilesize
120KB
-
memory/2220-144-0x000000000FA60000-0x000000000FC22000-memory.dmpFilesize
1.8MB
-
memory/2220-145-0x000000000FC30000-0x000000001015C000-memory.dmpFilesize
5.2MB