Analysis
-
max time kernel
152s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 22:55
Behavioral task
behavioral1
Sample
d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe
-
Size
175KB
-
MD5
7aa7867a962e02f0ca753f3b2037fd03
-
SHA1
f08170de3e21d58b82c4918b7a3ef9c25c71bb64
-
SHA256
d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a
-
SHA512
8b0fabfdde37d49097ecbeb438a6ae070542e2fa4d7327923d4262ae50e28c1e3b9373b959ce5fc7e1ff86aab5dda2671b39a7f078b0a9c7d4650add90e89ca7
-
SSDEEP
3072:6NQKPWDyzI0fFJltZrpReFX3GC8u0m92DNAYllgjEtLL081O0FmWGcs0RKRdWy1N:6NSDyzIkFthpr8042h9TgjMvvzFmWGcm
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1368-55-0x0000000001000000-0x0000000001055000-memory.dmp upx behavioral1/memory/1368-96-0x0000000001000000-0x0000000001055000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\V: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\F: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\H: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\I: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\K: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\M: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\N: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\S: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\T: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\E: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\G: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\U: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\Q: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\R: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\W: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\X: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\L: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\O: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\Z: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\J: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened (read-only) \??\Y: d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\wbengine.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File created \??\c:\windows\SysWOW64\msiexec.vir d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File created \??\c:\windows\SysWOW64\dllhost.vir d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File created \??\c:\windows\SysWOW64\searchindexer.vir d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File created \??\c:\windows\SysWOW64\svchost.vir d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\7-Zip\Uninstall.vir d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\7-Zip\7zG.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\7-Zip\7z.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C8F6161B-1DCD-4DF3-927F-C28E9A6E43AC}.crmlog dllhost.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C8F6161B-1DCD-4DF3-927F-C28E9A6E43AC}.crmlog dllhost.exe File opened for modification \??\c:\windows\ehome\ehsched.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1368 d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeSecurityPrivilege 1136 msiexec.exe Token: SeManageVolumePrivilege 1336 SearchIndexer.exe Token: 33 1336 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1336 SearchIndexer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1040 SearchProtocolHost.exe 1040 SearchProtocolHost.exe 1040 SearchProtocolHost.exe 1040 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1336 wrote to memory of 1040 1336 SearchIndexer.exe 30 PID 1336 wrote to memory of 1040 1336 SearchIndexer.exe 30 PID 1336 wrote to memory of 1040 1336 SearchIndexer.exe 30 PID 1336 wrote to memory of 1684 1336 SearchIndexer.exe 31 PID 1336 wrote to memory of 1684 1336 SearchIndexer.exe 31 PID 1336 wrote to memory of 1684 1336 SearchIndexer.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe"C:\Users\Admin\AppData\Local\Temp\d57576c96c8c4ce84e3ec6adcf5ba4ea364e80272fc30d5b6ceba7353fed080a.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:1808
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-999675638-2867687379-27515722-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-999675638-2867687379-27515722-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:1040
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 5202⤵PID:1684
-