Analysis
- max time kernel
112s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
29/12/2022, 20:16
Behavioral task
behavioral1
Sample
a1b3c955760a198517952f33f889c574.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
General
- Target a1b3c955760a198517952f33f889c574.exe
- Size 168KB
- Sample221229-y14tkshc9x
- SHA256 d2f4cbf952047e9df3d8177f858e1c1ca400d47f5450bd64a362a6ddbb68b29c
- MD5 a1b3c955760a198517952f33f889c574
- SHA1 3a49690eb42a28c4e4000434a1cd84d2436d6606
- SHA512 a3c45d88b2d048f0013b4c0b13e10c1652489a8e86998b634d6695edf577b8c1f1d22b6ff08b40cf02cfdf23a0e47f505962341a1581126ac604d8b962fa3072
- SSDEEP 1536:wkHRtCOAqTMxrZUH0xzqz6Zec5JdfrFHBvRo/9OD6TvmEki6kzZ9emWXv6t7nKNo:zu3zTqOZN/EODtEki1wfwKuQBdjh4tr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts a1b3c955760a198517952f33f889c574.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook a1b3c955760a198517952f33f889c574.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeImpersonatePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeTcbPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeChangeNotifyPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeCreateTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeBackupPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeRestorePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeIncreaseQuotaPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeAssignPrimaryTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeImpersonatePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeTcbPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeChangeNotifyPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeCreateTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeBackupPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeRestorePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeIncreaseQuotaPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeAssignPrimaryTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeImpersonatePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeTcbPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeChangeNotifyPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeCreateTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeBackupPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeRestorePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeIncreaseQuotaPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeAssignPrimaryTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeImpersonatePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeTcbPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeChangeNotifyPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeCreateTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeBackupPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeRestorePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeIncreaseQuotaPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeAssignPrimaryTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeImpersonatePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeTcbPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeChangeNotifyPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeCreateTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeBackupPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeRestorePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeIncreaseQuotaPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeAssignPrimaryTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeImpersonatePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeTcbPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeChangeNotifyPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeCreateTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeBackupPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeRestorePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeIncreaseQuotaPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeAssignPrimaryTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeImpersonatePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeTcbPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeChangeNotifyPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeCreateTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeBackupPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeRestorePrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeIncreaseQuotaPrivilege 1568 a1b3c955760a198517952f33f889c574.exe Token: SeAssignPrimaryTokenPrivilege 1568 a1b3c955760a198517952f33f889c574.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook a1b3c955760a198517952f33f889c574.exe