Analysis
-
max time kernel
152s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09/02/2023, 08:52
Behavioral task
behavioral1
Sample
d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe
Resource
win7-20220901-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe
-
Size
209KB
-
MD5
7ce13de5f6432204b925c56f34f70686
-
SHA1
542c31c3907bdbf62496ed73edae98ca57c69db1
-
SHA256
d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb
-
SHA512
39bcaeb546f0d55d25f2608b5b6bae619fb4029edc6e89b3ce61ebf5ef96a4b131e1e53ebb7fcdafadbfef4cd615995c4a585996df5b6c8ccdb83b62e3199938
-
SSDEEP
3072:VrM4SygTxhnOFMWAFGUYHy+j03DeZ1K6JRNMhqJZlX6q+beI2e5wzrWUDOO1:uygTrntzqjwDe31NzJrXL+2uKrWG
Score
8/10
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4736-132-0x0000000000400000-0x00000000004E4000-memory.dmp upx behavioral2/memory/4736-134-0x0000000000400000-0x00000000004E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\SearchFilterHost = "cmd /c \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe\" --zxcv" d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4108 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1588 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe Token: SeDebugPrivilege 1588 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4736 wrote to memory of 5016 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 80 PID 4736 wrote to memory of 5016 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 80 PID 4736 wrote to memory of 5016 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 80 PID 4736 wrote to memory of 4848 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 83 PID 4736 wrote to memory of 4848 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 83 PID 4736 wrote to memory of 4848 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 83 PID 4736 wrote to memory of 996 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 92 PID 4736 wrote to memory of 996 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 92 PID 4736 wrote to memory of 996 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 92 PID 4736 wrote to memory of 4712 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 85 PID 4736 wrote to memory of 4712 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 85 PID 4736 wrote to memory of 4712 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 85 PID 4736 wrote to memory of 4988 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 86 PID 4736 wrote to memory of 4988 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 86 PID 4736 wrote to memory of 4988 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 86 PID 4736 wrote to memory of 4108 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 89 PID 4736 wrote to memory of 4108 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 89 PID 4736 wrote to memory of 4108 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 89 PID 4988 wrote to memory of 3584 4988 CMD.exe 93 PID 4988 wrote to memory of 3584 4988 CMD.exe 93 PID 4736 wrote to memory of 1588 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 94 PID 4736 wrote to memory of 1588 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 94 PID 4736 wrote to memory of 1588 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 94 PID 4736 wrote to memory of 4784 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 96 PID 4736 wrote to memory of 4784 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 96 PID 4736 wrote to memory of 4784 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 96 PID 4736 wrote to memory of 4524 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 98 PID 4736 wrote to memory of 4524 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 98 PID 4736 wrote to memory of 4524 4736 d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe"C:\Users\Admin\AppData\Local\Temp\d1305b7e672aee7d0bd3ca8f9b7c2706536d7822249af8c925d86595d39aaacb.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\CMD.exeCMD /C RD %TEMP% /S/Q & MKDIR %TEMP%2⤵PID:5016
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f2⤵
- Adds Run key to start application
PID:4848
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /f2⤵
- Adds Run key to start application
PID:4712
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C %WINDIR%\sysnative\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\system32\reg.exeC:\Windows\sysnative\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f3⤵
- Adds Run key to start application
PID:3584
-
-
-
C:\Windows\SysWOW64\sc.exesc delete syshost322⤵
- Launches sc.exe
PID:4108
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f2⤵PID:996
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im msiexec.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" CMD /C DEL /F /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.* "2⤵PID:4784
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" CMD /C DEL /F /S /Q "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.* "2⤵PID:4524
-