Analysis
-
max time kernel
284s -
max time network
384s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 16:33
Static task
static1
Behavioral task
behavioral1
Sample
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe
Resource
win10v2004-20220812-en
General
-
Target
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe
-
Size
292KB
-
MD5
99c4e136a26726a185b33254800dbbdf
-
SHA1
a1e30ac3e313cd345bc764b944c58c941f21e67e
-
SHA256
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311
-
SHA512
d8ccca69a051df889beff4714a4c168767662e3c3080209dd7b8b2909913e152b5754c1d0c72d76caebd3323f8b6c17e54cd666dd721f19faff1541439f94d4d
-
SSDEEP
3072:ZKT0SCy4QDMT/1BvOeA7WTe7FLljBaPNr7varwVbUZUev2b+:Z/vX/1m37FPkNlTeO
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
ComputerDefaults.exepid process 1856 ComputerDefaults.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\{A6F511EB-CE96-59FB-6A15-0FBA6244E6C1} = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\pe9iawd3.default-release\\chkntfs.exe" 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exeComputerDefaults.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ComputerDefaults.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ComputerDefaults.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ComputerDefaults.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
Processes:
ComputerDefaults.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" ComputerDefaults.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
ComputerDefaults.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" ComputerDefaults.exe -
Processes:
ComputerDefaults.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main ComputerDefaults.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exeComputerDefaults.exepid process 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe 1856 ComputerDefaults.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ComputerDefaults.exexpsrchvw.exedescription pid process Token: SeDebugPrivilege 1856 ComputerDefaults.exe Token: SeDebugPrivilege 1336 xpsrchvw.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exeComputerDefaults.exedescription pid process target process PID 784 wrote to memory of 1856 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe ComputerDefaults.exe PID 784 wrote to memory of 1856 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe ComputerDefaults.exe PID 784 wrote to memory of 1856 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe ComputerDefaults.exe PID 784 wrote to memory of 1856 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe ComputerDefaults.exe PID 784 wrote to memory of 1856 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe ComputerDefaults.exe PID 784 wrote to memory of 1856 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe ComputerDefaults.exe PID 784 wrote to memory of 1856 784 2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe ComputerDefaults.exe PID 1856 wrote to memory of 1336 1856 ComputerDefaults.exe xpsrchvw.exe PID 1856 wrote to memory of 1336 1856 ComputerDefaults.exe xpsrchvw.exe PID 1856 wrote to memory of 1336 1856 ComputerDefaults.exe xpsrchvw.exe PID 1856 wrote to memory of 1336 1856 ComputerDefaults.exe xpsrchvw.exe PID 1856 wrote to memory of 1336 1856 ComputerDefaults.exe xpsrchvw.exe PID 1856 wrote to memory of 1336 1856 ComputerDefaults.exe xpsrchvw.exe PID 1856 wrote to memory of 1336 1856 ComputerDefaults.exe xpsrchvw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe"C:\Users\Admin\AppData\Local\Temp\2096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe2⤵
- Deletes itself
- Checks processor information in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\xpsrchvw.exeC:\Windows\System32\xpsrchvw.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pe9iawd3.default-release\chkntfs.exeFilesize
292KB
MD599c4e136a26726a185b33254800dbbdf
SHA1a1e30ac3e313cd345bc764b944c58c941f21e67e
SHA2562096ffb021f80686e43b7ccd2bb64c20031472d90bcadadded16f4a8bbd7c311
SHA512d8ccca69a051df889beff4714a4c168767662e3c3080209dd7b8b2909913e152b5754c1d0c72d76caebd3323f8b6c17e54cd666dd721f19faff1541439f94d4d
-
memory/784-54-0x00000000767C1000-0x00000000767C3000-memory.dmpFilesize
8KB
-
memory/784-55-0x0000000000220000-0x0000000000230000-memory.dmpFilesize
64KB
-
memory/784-56-0x00000000002E0000-0x0000000000328000-memory.dmpFilesize
288KB
-
memory/784-59-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/784-60-0x00000000002E0000-0x0000000000328000-memory.dmpFilesize
288KB
-
memory/784-66-0x00000000002E0000-0x0000000000328000-memory.dmpFilesize
288KB
-
memory/1336-103-0x0000000000100000-0x0000000000148000-memory.dmpFilesize
288KB
-
memory/1336-100-0x0000000000100000-0x0000000000148000-memory.dmpFilesize
288KB
-
memory/1336-98-0x0000000000000000-mapping.dmp
-
memory/1856-78-0x0000000075E10000-0x0000000075E57000-memory.dmpFilesize
284KB
-
memory/1856-89-0x0000000075E10000-0x0000000075E57000-memory.dmpFilesize
284KB
-
memory/1856-73-0x0000000075E10000-0x0000000075E57000-memory.dmpFilesize
284KB
-
memory/1856-68-0x0000000000150000-0x0000000000198000-memory.dmpFilesize
288KB
-
memory/1856-86-0x0000000000150000-0x0000000000198000-memory.dmpFilesize
288KB
-
memory/1856-87-0x0000000077840000-0x00000000779C0000-memory.dmpFilesize
1.5MB
-
memory/1856-88-0x0000000076560000-0x0000000076670000-memory.dmpFilesize
1.1MB
-
memory/1856-74-0x00000000767C0000-0x000000007740A000-memory.dmpFilesize
12.3MB
-
memory/1856-90-0x0000000077840000-0x00000000779C0000-memory.dmpFilesize
1.5MB
-
memory/1856-91-0x0000000077840000-0x00000000779C0000-memory.dmpFilesize
1.5MB
-
memory/1856-93-0x0000000077840000-0x00000000779C0000-memory.dmpFilesize
1.5MB
-
memory/1856-92-0x0000000077840000-0x00000000779C0000-memory.dmpFilesize
1.5MB
-
memory/1856-65-0x0000000000000000-mapping.dmp
-
memory/1856-63-0x0000000000150000-0x0000000000198000-memory.dmpFilesize
288KB
-
memory/1856-61-0x00000000001A0000-0x00000000001E9000-memory.dmpFilesize
292KB