Analysis
-
max time kernel
155s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 11:13
Static task
static1
Behavioral task
behavioral1
Sample
f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe
-
Size
126KB
-
MD5
056fef6c349dd03925c26e7732ae4370
-
SHA1
7aee423fb4a85beda6abce75a74d446729e2a218
-
SHA256
f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d
-
SHA512
5ce2efa2ea5a0e802e1cc67857c66f9c4266c5884700f284f231f79cb0a4ba31b327b05a0da89bc0c45122bbeebf4b480105fa5e43e4f23f9bdf3f7675a6bee7
-
SSDEEP
3072:zpF3T6kXMn/Yf96OHt1SNh/dX2miQpWv2IeXhHYM4p4m0e1Am:zHOUMnY96OmN7l/ieX11Y
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSASCui.exe" f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4028 set thread context of 1960 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 83 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe Token: SeDebugPrivilege 1960 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4028 wrote to memory of 1960 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 83 PID 4028 wrote to memory of 1960 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 83 PID 4028 wrote to memory of 1960 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 83 PID 4028 wrote to memory of 1960 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 83 PID 4028 wrote to memory of 1960 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 83 PID 4028 wrote to memory of 1960 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 83 PID 4028 wrote to memory of 1960 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 83 PID 4028 wrote to memory of 1960 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 83 PID 4028 wrote to memory of 1960 4028 f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe"C:\Users\Admin\AppData\Local\Temp\f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exeC:\Users\Admin\AppData\Local\Temp\f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\f4486eaeca1f35ee98e6592497f60b6f620ea3c7c7d95621f509aca214736b8d.exe.log
Filesize319B
MD5a4da81a3544d9cd85f257967c0a431fe
SHA1ba6f59ae5c6a2674a1fda758b5ded92f76d5edb3
SHA256ad372efe5e610b9c2a331ac8f17f83542ef78b92c875c206d76c84e158fb271e
SHA51212348d4cb4b6534a43f122d18fc7276c524c5b7e8f242f446eefb4d2ffea8018aed53a854cb840b2f30669caf74d14daff4276c6676a15221c58c84b210d393f