Analysis
-
max time kernel
49s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2023 08:36
Static task
static1
Behavioral task
behavioral1
Sample
MW1.exe
Resource
win7-20221111-en
windows7-x64
2 signatures
120 seconds
General
-
Target
MW1.exe
-
Size
49KB
-
MD5
a193637649d17718e7a3b69d5eaa608e
-
SHA1
ab325d5e499fe12c184ccec5537690ab0cba9fd8
-
SHA256
30570f1bc186e7ed9d46ac01aebde9300faf1ee4b6884a004e4e0fd8e2f11d59
-
SHA512
fbbb21526c2813b9eb6e6b9be59b38ad8a71269f425793e57c5789a4ad63d6ebe68bdbea790f39a499e584c0bae0256bd4ae80ea34ad9806f918aaaa09d72c2e
-
SSDEEP
768:h5EEmRla+Ig3yS+oHsiLwrH5qtJDGUl0Uf/gSoxCAZMDO6eg:h8a+eSAi8H0tJD2UfEWJ
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini MW1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 37 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini MW1.exe File created C:\Users\Admin\Links\desktop.ini MW1.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini MW1.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini MW1.exe File created C:\Users\Admin\Contacts\desktop.ini MW1.exe File created C:\Users\Admin\Music\desktop.ini MW1.exe File created C:\Users\Admin\OneDrive\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini MW1.exe File created C:\Users\Admin\Saved Games\desktop.ini MW1.exe File created C:\Users\Admin\Videos\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini MW1.exe File created C:\Users\Admin\Desktop\desktop.ini MW1.exe File created C:\Users\Admin\Searches\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini MW1.exe File created C:\Users\Admin\Favorites\desktop.ini MW1.exe File created C:\Users\Admin\Pictures\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini MW1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini MW1.exe File created C:\Users\Admin\Documents\desktop.ini MW1.exe File created C:\Users\Admin\Downloads\desktop.ini MW1.exe File created C:\Users\Admin\Favorites\Links\desktop.ini MW1.exe File created C:\Users\Admin\3D Objects\desktop.ini MW1.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini MW1.exe