Analysis
-
max time kernel
103s -
max time network
108s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 20:46
Static task
static1
Behavioral task
behavioral1
Sample
a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe
-
Size
3.8MB
-
MD5
4873e1142fdd3d0a82e6b1a55f4b6aec
-
SHA1
6d487e39d62648e8b7b5d74ebcd1da8b9190a0cc
-
SHA256
a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379
-
SHA512
f70f62cb5945599b8cfba8fa876bb96f787575d18d816009b77e28b68f5e3dfd97843261df545363e9ee4a814dd3fef3dcda33871e7357a0daa0f83cef9afec9
-
SSDEEP
98304:4j/78ORh8OHoB/mW0oLH5FepMBfZoKM2seMw3R2e:4ToORvoxN0ozUMBeKM2seM+ke
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" reg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe -
Runs net.exe
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2008 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 26 PID 1424 wrote to memory of 2008 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 26 PID 1424 wrote to memory of 2008 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 26 PID 1424 wrote to memory of 2008 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 26 PID 1424 wrote to memory of 1204 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 28 PID 1424 wrote to memory of 1204 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 28 PID 1424 wrote to memory of 1204 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 28 PID 1424 wrote to memory of 1204 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 28 PID 1424 wrote to memory of 1540 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 30 PID 1424 wrote to memory of 1540 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 30 PID 1424 wrote to memory of 1540 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 30 PID 1424 wrote to memory of 1540 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 30 PID 1424 wrote to memory of 976 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 31 PID 1424 wrote to memory of 976 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 31 PID 1424 wrote to memory of 976 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 31 PID 1424 wrote to memory of 976 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 31 PID 1424 wrote to memory of 1976 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 34 PID 1424 wrote to memory of 1976 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 34 PID 1424 wrote to memory of 1976 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 34 PID 1424 wrote to memory of 1976 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 34 PID 1424 wrote to memory of 1772 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 35 PID 1424 wrote to memory of 1772 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 35 PID 1424 wrote to memory of 1772 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 35 PID 1424 wrote to memory of 1772 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 35 PID 1424 wrote to memory of 1984 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 38 PID 1424 wrote to memory of 1984 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 38 PID 1424 wrote to memory of 1984 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 38 PID 1424 wrote to memory of 1984 1424 a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe 38 PID 1540 wrote to memory of 112 1540 cmd.exe 40 PID 1540 wrote to memory of 112 1540 cmd.exe 40 PID 1540 wrote to memory of 112 1540 cmd.exe 40 PID 1540 wrote to memory of 112 1540 cmd.exe 40 PID 976 wrote to memory of 1640 976 cmd.exe 41 PID 976 wrote to memory of 1640 976 cmd.exe 41 PID 976 wrote to memory of 1640 976 cmd.exe 41 PID 976 wrote to memory of 1640 976 cmd.exe 41 PID 1772 wrote to memory of 1792 1772 cmd.exe 42 PID 1772 wrote to memory of 1792 1772 cmd.exe 42 PID 1772 wrote to memory of 1792 1772 cmd.exe 42 PID 1772 wrote to memory of 1792 1772 cmd.exe 42 PID 1984 wrote to memory of 1796 1984 cmd.exe 43 PID 1984 wrote to memory of 1796 1984 cmd.exe 43 PID 1984 wrote to memory of 1796 1984 cmd.exe 43 PID 1984 wrote to memory of 1796 1984 cmd.exe 43 PID 1640 wrote to memory of 916 1640 net.exe 45 PID 1640 wrote to memory of 916 1640 net.exe 45 PID 1640 wrote to memory of 916 1640 net.exe 45 PID 1640 wrote to memory of 916 1640 net.exe 45 PID 112 wrote to memory of 1096 112 net.exe 44 PID 112 wrote to memory of 1096 112 net.exe 44 PID 112 wrote to memory of 1096 112 net.exe 44 PID 112 wrote to memory of 1096 112 net.exe 44 PID 2008 wrote to memory of 1588 2008 net.exe 46 PID 2008 wrote to memory of 1588 2008 net.exe 46 PID 2008 wrote to memory of 1588 2008 net.exe 46 PID 2008 wrote to memory of 1588 2008 net.exe 46 PID 1204 wrote to memory of 1296 1204 net.exe 47 PID 1204 wrote to memory of 1296 1204 net.exe 47 PID 1204 wrote to memory of 1296 1204 net.exe 47 PID 1204 wrote to memory of 1296 1204 net.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe"C:\Users\Admin\AppData\Local\Temp\a0f34541b754693065ed2347b0f1f2ad33a815ebf7661dee0f50ed7edc5ec379.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\net.exenet stop wscsvc2⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc3⤵PID:1588
-
-
-
C:\Windows\SysWOW64\net.exenet stop sharedaccess2⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess3⤵PID:1296
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Security Center"2⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\net.exenet stop "Security Center"3⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"4⤵PID:1096
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SharedAccess2⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:916
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess" /v Start /t REG_DWORD /d 0x4 /f2⤵PID:1976
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v Start /t REG_DWORD /d 0x4 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v Start /t REG_DWORD /d 0x4 /f3⤵
- Modifies security service
PID:1792
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v Start /t REG_DWORD /d 0x4 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v Start /t REG_DWORD /d 0x4 /f3⤵
- Modifies security service
PID:1796
-
-