Analysis
-
max time kernel
105s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-10-2022 18:20
Behavioral task
behavioral1
Sample
3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe
-
Size
317KB
-
MD5
81d444f5b63e8177b2595e066024a85f
-
SHA1
1ba9efae1c2371dad7ea6e339902ec58389e6a1d
-
SHA256
3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c
-
SHA512
8d48c09167a36a47341b25d8fec3380f665eb05564d45bde9ed66d43d678b4b4d4e2d8e82597fa8bdf283b7a24f20a4f18d076c88e8ea5b70f55fec8da7475a3
-
SSDEEP
6144:XCcN9GQKvPKxyfptBr6fHRFmNN5yWMj6+ggfazRNFYyzwW:ScNdKnKxyx7C1PO
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1060-57-0x0000000001000000-0x0000000001078000-memory.dmp upx behavioral1/memory/1060-98-0x0000000001000000-0x0000000001078000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\U: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\X: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\Z: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\G: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\H: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\L: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\N: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\P: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\Q: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\J: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\K: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\O: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\V: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\Y: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\E: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\I: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\R: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\T: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\W: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\F: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened (read-only) \??\M: 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File created \??\c:\windows\SysWOW64\searchindexer.vir 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File created \??\c:\windows\SysWOW64\msiexec.vir 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File created \??\c:\windows\SysWOW64\svchost.vir 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File created \??\c:\windows\SysWOW64\dllhost.vir 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification C:\Program Files\7-Zip\7z.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File created C:\Program Files\7-Zip\Uninstall.vir 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\windows\servicing\trustedinstaller.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\ehome\ehsched.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1123436B-5273-437F-B7E4-BF7A760AABFE}.crmlog dllhost.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1123436B-5273-437F-B7E4-BF7A760AABFE}.crmlog dllhost.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1060 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe Token: SeRestorePrivilege 1948 msiexec.exe Token: SeTakeOwnershipPrivilege 1948 msiexec.exe Token: SeSecurityPrivilege 1948 msiexec.exe Token: SeManageVolumePrivilege 2016 SearchIndexer.exe Token: 33 2016 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2016 SearchIndexer.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1060 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe 1060 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe 1060 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe 1212 SearchProtocolHost.exe 1212 SearchProtocolHost.exe 1212 SearchProtocolHost.exe 1212 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1060 wrote to memory of 2020 1060 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe 27 PID 1060 wrote to memory of 2020 1060 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe 27 PID 1060 wrote to memory of 2020 1060 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe 27 PID 1060 wrote to memory of 2020 1060 3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe 27 PID 2016 wrote to memory of 1212 2016 SearchIndexer.exe 31 PID 2016 wrote to memory of 1212 2016 SearchIndexer.exe 31 PID 2016 wrote to memory of 1212 2016 SearchIndexer.exe 31 PID 2016 wrote to memory of 1076 2016 SearchIndexer.exe 32 PID 2016 wrote to memory of 1076 2016 SearchIndexer.exe 32 PID 2016 wrote to memory of 1076 2016 SearchIndexer.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe"C:\Users\Admin\AppData\Local\Temp\3ab305109c53e5658762d852a3d68415acfc1567a10f5ef6eefd5b12594ea42c.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2020
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:316
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4063495947-34355257-727531523-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4063495947-34355257-727531523-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:1212
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 5202⤵PID:1076
-