Analysis
-
max time kernel
152s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 17:19
Behavioral task
behavioral1
Sample
1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
General
-
Target
1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe
-
Size
209KB
-
MD5
05c1c2523b43d42dee6e62c0e5514799
-
SHA1
c3b5afc39ea9a7f9cdafae9a68876977e9ba78a3
-
SHA256
1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f
-
SHA512
7913f15678fbdec8941a2d9c4df84a330c09a46db77a0edd83358d64cff0c2a43956b3a1a1b6ba2d6eadf433fbecacae39f37114563ecf135468403469f3253b
-
SSDEEP
3072:B69jcVpCVCkJYBoUcWsLJLc+Ig5mdCyI7nYULfUT0dAkr+c5SEqx:UBcVJJGUoNL+g59LfUTa52
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1248-57-0x0000000001000000-0x000000000105C000-memory.dmp upx behavioral1/memory/1248-98-0x0000000001000000-0x000000000105C000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\H: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\R: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\Q: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\S: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\G: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\N: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\K: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\L: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\E: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\F: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\M: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\O: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\P: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\T: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\U: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\W: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\I: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\J: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\Z: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\X: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened (read-only) \??\Y: 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\alg.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File created \??\c:\windows\SysWOW64\dllhost.vir 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File created \??\c:\windows\SysWOW64\msiexec.vir 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File created \??\c:\windows\SysWOW64\svchost.vir 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File created \??\c:\windows\SysWOW64\searchindexer.vir 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File created C:\Program Files\7-Zip\Uninstall.vir 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\7-Zip\7z.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{61125A6B-C763-4139-AB0F-9696F4FA99A4}.crmlog dllhost.exe File opened for modification \??\c:\windows\ehome\ehsched.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{61125A6B-C763-4139-AB0F-9696F4FA99A4}.crmlog dllhost.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1248 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe Token: SeRestorePrivilege 1752 msiexec.exe Token: SeTakeOwnershipPrivilege 1752 msiexec.exe Token: SeSecurityPrivilege 1752 msiexec.exe Token: SeManageVolumePrivilege 1336 SearchIndexer.exe Token: 33 1336 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1336 SearchIndexer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 560 SearchProtocolHost.exe 560 SearchProtocolHost.exe 560 SearchProtocolHost.exe 560 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1248 wrote to memory of 1136 1248 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe 26 PID 1248 wrote to memory of 1136 1248 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe 26 PID 1248 wrote to memory of 1136 1248 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe 26 PID 1248 wrote to memory of 1136 1248 1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe 26 PID 1336 wrote to memory of 560 1336 SearchIndexer.exe 30 PID 1336 wrote to memory of 560 1336 SearchIndexer.exe 30 PID 1336 wrote to memory of 560 1336 SearchIndexer.exe 30 PID 1336 wrote to memory of 432 1336 SearchIndexer.exe 31 PID 1336 wrote to memory of 432 1336 SearchIndexer.exe 31 PID 1336 wrote to memory of 432 1336 SearchIndexer.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe"C:\Users\Admin\AppData\Local\Temp\1703851ce7048afbb85423cebcdd3b062fc4b8ebc8029a1bcc795bb23c7ddd1f.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\system32\msra.exe"C:\Windows\system32\msra.exe"2⤵PID:1136
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:880
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-999675638-2867687379-27515722-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-999675638-2867687379-27515722-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:560
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 5202⤵PID:432
-