Analysis
- max time kernel
52s - max time network
185s - platform
windows10-1703_x64 - resource
win10-20230220-en - resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system - submitted
20/02/2023, 22:17
Behavioral task
behavioral1
Sample
14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
300 seconds
General
- Target 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe
- Size 4.4MB
- Sample230220-17cpsacg22
- SHA256 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf
- MD5 15ae1218c1c773497a6a5e6db8d11922
- SHA1 8596dbd6e5e7dfdfbacd04051d192dd597d72b67
- SHA512 57c417052ace7f7e1b4c60da0549e733e6e1bcc35c3c952a0595501248ef25a801e71148d55334aeb38c57a9ecb851476f7c34fab86ee00d319e95ac79f4c45b
- SSDEEP 49152:yb9BphIVBmo8cBBThHHCrmYVzZLbdIo0MaN5EyKktGH5R7of01N:ipCmo/CrmyVYEqGZR7n
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1960 powershell.exe 1960 powershell.exe 1960 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3372 wmic.exe Token: SeSecurityPrivilege 3372 wmic.exe Token: SeTakeOwnershipPrivilege 3372 wmic.exe Token: SeLoadDriverPrivilege 3372 wmic.exe Token: SeSystemProfilePrivilege 3372 wmic.exe Token: SeSystemtimePrivilege 3372 wmic.exe Token: SeProfSingleProcessPrivilege 3372 wmic.exe Token: SeIncBasePriorityPrivilege 3372 wmic.exe Token: SeCreatePagefilePrivilege 3372 wmic.exe Token: SeBackupPrivilege 3372 wmic.exe Token: SeRestorePrivilege 3372 wmic.exe Token: SeShutdownPrivilege 3372 wmic.exe Token: SeDebugPrivilege 3372 wmic.exe Token: SeSystemEnvironmentPrivilege 3372 wmic.exe Token: SeRemoteShutdownPrivilege 3372 wmic.exe Token: SeUndockPrivilege 3372 wmic.exe Token: SeManageVolumePrivilege 3372 wmic.exe Token: 33 3372 wmic.exe Token: 34 3372 wmic.exe Token: 35 3372 wmic.exe Token: 36 3372 wmic.exe Token: SeIncreaseQuotaPrivilege 3372 wmic.exe Token: SeSecurityPrivilege 3372 wmic.exe Token: SeTakeOwnershipPrivilege 3372 wmic.exe Token: SeLoadDriverPrivilege 3372 wmic.exe Token: SeSystemProfilePrivilege 3372 wmic.exe Token: SeSystemtimePrivilege 3372 wmic.exe Token: SeProfSingleProcessPrivilege 3372 wmic.exe Token: SeIncBasePriorityPrivilege 3372 wmic.exe Token: SeCreatePagefilePrivilege 3372 wmic.exe Token: SeBackupPrivilege 3372 wmic.exe Token: SeRestorePrivilege 3372 wmic.exe Token: SeShutdownPrivilege 3372 wmic.exe Token: SeDebugPrivilege 3372 wmic.exe Token: SeSystemEnvironmentPrivilege 3372 wmic.exe Token: SeRemoteShutdownPrivilege 3372 wmic.exe Token: SeUndockPrivilege 3372 wmic.exe Token: SeManageVolumePrivilege 3372 wmic.exe Token: 33 3372 wmic.exe Token: 34 3372 wmic.exe Token: 35 3372 wmic.exe Token: 36 3372 wmic.exe Token: SeIncreaseQuotaPrivilege 4640 WMIC.exe Token: SeSecurityPrivilege 4640 WMIC.exe Token: SeTakeOwnershipPrivilege 4640 WMIC.exe Token: SeLoadDriverPrivilege 4640 WMIC.exe Token: SeSystemProfilePrivilege 4640 WMIC.exe Token: SeSystemtimePrivilege 4640 WMIC.exe Token: SeProfSingleProcessPrivilege 4640 WMIC.exe Token: SeIncBasePriorityPrivilege 4640 WMIC.exe Token: SeCreatePagefilePrivilege 4640 WMIC.exe Token: SeBackupPrivilege 4640 WMIC.exe Token: SeRestorePrivilege 4640 WMIC.exe Token: SeShutdownPrivilege 4640 WMIC.exe Token: SeDebugPrivilege 4640 WMIC.exe Token: SeSystemEnvironmentPrivilege 4640 WMIC.exe Token: SeRemoteShutdownPrivilege 4640 WMIC.exe Token: SeUndockPrivilege 4640 WMIC.exe Token: SeManageVolumePrivilege 4640 WMIC.exe Token: 33 4640 WMIC.exe Token: 34 4640 WMIC.exe Token: 35 4640 WMIC.exe Token: 36 4640 WMIC.exe Token: SeIncreaseQuotaPrivilege 4640 WMIC.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3032 wrote to memory of 3372 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe 66 PID 3032 wrote to memory of 3372 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe 66 PID 3032 wrote to memory of 4424 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe 69 PID 3032 wrote to memory of 4424 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe 69 PID 4424 wrote to memory of 4640 4424 cmd.exe 71 PID 4424 wrote to memory of 4640 4424 cmd.exe 71 PID 3032 wrote to memory of 4904 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe 72 PID 3032 wrote to memory of 4904 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe 72 PID 4904 wrote to memory of 4332 4904 cmd.exe 74 PID 4904 wrote to memory of 4332 4904 cmd.exe 74 PID 3032 wrote to memory of 1960 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe 75 PID 3032 wrote to memory of 1960 3032 14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe"C:\Users\Admin\AppData\Local\Temp\14711577406a5d442440b680200c3e2837cdbefe8416f0b50a98849d602b04cf.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4332
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "start-process C:\Users\Admin\AppData\Local\Temp\Dprrjmi5gZ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Dprrjmi5gZ.exe
- Size 12KB
- SHA256 61384aba1c6c68f6f5831d11562eab170190fa82a486ddc0a053f66bdf8d318b
- MD5 7ebbd259d42e0f20e01e0a336b774311
- SHA1 d6d69bc9ec62b0fc6cb432bb2af3bfc60e4bd312
- SHA512 36d750b6cc370a007329d30bbd70627acedd08c54c62d553f0662a0f9c2026fa2b378ac57d0c802a1ea2c1dee75b73e36b56bd5ef9483e717dea5f0f20ca4d78
- SSDEEP 192:/HI8ApZ+baa38c4msIupQZwEmP6BL+eLZG7YEfbp0UmiJyv:A8sZ+Z4xQZwEfBL+eLZG7DbKLt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jyxwagpg.pia.ps1
- Size 1B
- SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
- MD5 c4ca4238a0b923820dcc509a6f75849b
- SHA1 356a192b7913b04c54574d18c28d46e6395428ab
- SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
- Size 72KB
- SHA256 17a69481ffd684f025b0fe6b0f22529bd8454c49915e580da43fcb08a0c56e4e
- MD5 2b8e1b75b4d4fdf0c640838191ac3946
- SHA1 dfac012ccaa015f6a9ec5bd1c55ffa7b8074fb7f
- SHA512 3c4de03250813dc78b772cc7e3246ac2726c37fae00844bfceda683e05506b53ba7ea95a06e2929e8ec736ccd50a9138e9f6e3c80980ebde5ed7ac66f06cc038
- SSDEEP 1536:+iDYk/Q/OccbxYiWU/vXyVOlgZiHGOM7nF+ABbauqzgk:+MH/Q/6Zp/viVwg0GOM7Vzk
- MD5 SHA1 SHA512 SSDEEP