Analysis

  • max time kernel
    19s
  • max time network
    108s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    02-03-2023 12:30

General

  • Target

    2dafde8db9931b339d3c4e02211d1510.exe

  • Size

    1.4MB

  • MD5

    2dafde8db9931b339d3c4e02211d1510

  • SHA1

    de7784c8b122b3a0cede985a4f016c8d1dd2a291

  • SHA256

    fd03bb72a0c9a14456d200343547eea78cdfb8d0f07b9277312f456a3f367ef1

  • SHA512

    66bfa9c229f5a83f21f8b94bd5403317991a25a1b4691445bf8fbeb73a0846a8ca51b9bb2e8b708f82c6c346ab8e00f5cbd347da984086433b2137f14e6cc920

  • SSDEEP

    24576:qGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRXj5hjSU:ppEUIvU0N9jkpjweXt77z5td

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2dafde8db9931b339d3c4e02211d1510.exe
    "C:\Users\Admin\AppData\Local\Temp\2dafde8db9931b339d3c4e02211d1510.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im chrome.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1700
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      2⤵
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:916
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6959758,0x7fef6959768,0x7fef6959778
        3⤵
          PID:1448
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1304,i,10311155623948649521,3344031095289426755,131072 /prefetch:2
          3⤵
            PID:1784
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1304,i,10311155623948649521,3344031095289426755,131072 /prefetch:8
            3⤵
              PID:1712
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1524 --field-trial-handle=1304,i,10311155623948649521,3344031095289426755,131072 /prefetch:8
              3⤵
                PID:676
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2224 --field-trial-handle=1304,i,10311155623948649521,3344031095289426755,131072 /prefetch:1
                3⤵
                  PID:760
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2244 --field-trial-handle=1304,i,10311155623948649521,3344031095289426755,131072 /prefetch:1
                  3⤵
                    PID:992
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1304,i,10311155623948649521,3344031095289426755,131072 /prefetch:1
                    3⤵
                      PID:1100
                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                  1⤵
                    PID:572

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html

                    Filesize

                    786B

                    MD5

                    9ffe618d587a0685d80e9f8bb7d89d39

                    SHA1

                    8e9cae42c911027aafae56f9b1a16eb8dd7a739c

                    SHA256

                    a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

                    SHA512

                    a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

                  • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png

                    Filesize

                    6KB

                    MD5

                    362695f3dd9c02c83039898198484188

                    SHA1

                    85dcacc66a106feca7a94a42fc43e08c806a0322

                    SHA256

                    40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca

                    SHA512

                    a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f

                  • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js

                    Filesize

                    3KB

                    MD5

                    c31f14d9b1b840e4b9c851cbe843fc8f

                    SHA1

                    205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4

                    SHA256

                    03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54

                    SHA512

                    2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa

                  • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js

                    Filesize

                    84KB

                    MD5

                    a09e13ee94d51c524b7e2a728c7d4039

                    SHA1

                    0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

                    SHA256

                    160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

                    SHA512

                    f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

                  • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json

                    Filesize

                    1KB

                    MD5

                    05bfb082915ee2b59a7f32fa3cc79432

                    SHA1

                    c1acd799ae271bcdde50f30082d25af31c1208c3

                    SHA256

                    04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1

                    SHA512

                    6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                    Filesize

                    61KB

                    MD5

                    e71c8443ae0bc2e282c73faead0a6dd3

                    SHA1

                    0c110c1b01e68edfacaeae64781a37b1995fa94b

                    SHA256

                    95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

                    SHA512

                    b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                    Filesize

                    264KB

                    MD5

                    f50f89a0a91564d0b8a211f8921aa7de

                    SHA1

                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                    SHA256

                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                    SHA512

                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                    Filesize

                    4KB

                    MD5

                    9b95eef1d9093a163ded24534888cbfd

                    SHA1

                    4de60f102071c8722e09365d9962421492105ffc

                    SHA256

                    303704b76800d7bc942694dfba5544adeba6ef7ebd8cf1a47e1ae7d04c05a9f0

                    SHA512

                    23583e3c0fb9a513e5926cf07549ae19cbe273235c1b7e2f4e1aaf3a0bc005c8cf3fd1ed316a1a8651141011d8db4ca1d3874ac212a22532455e884147db80f1

                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                    Filesize

                    4KB

                    MD5

                    c6b62f352e242f84bdf62377c4e25749

                    SHA1

                    ca180affbd1b27dfc5b3146802316e24162e96d9

                    SHA256

                    ed32f77d0f748ba446ce4ce593201b5ee2f7a4fe068579ab816b28985dc3f7de

                    SHA512

                    5b36e926349f4ed54523c7d59f0f8a74ed63ceb6c13bdfb8505c2e4d36d05a9391eefa8d81afd23c899b685456de7ecd7bbfce046666f1b327e5f55843c113e3

                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                    Filesize

                    11KB

                    MD5

                    a33ceb08b2d14456ffb8f3df87b9aa7c

                    SHA1

                    9613548af4e91f49ce3a3597135ce82ec498aa17

                    SHA256

                    6fafeb4e478edd8a009c37c63d0dd6ed3229742914790fb4594eb2a440b5e0b5

                    SHA512

                    6d58f787cca5b75120729adfdae2a6f625954d298fe5f84d71b63c55588f1b61de96ba5311e3d6958f58d9ca0e57df8c359b99cc521cf9d6be6c9e2906b6194c

                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                    Filesize

                    11KB

                    MD5

                    5fff1742dabfe19ad19b4397db36a16e

                    SHA1

                    6abdf966d2896376d1659d96d510b1a3604f6f93

                    SHA256

                    06798591b956eca58687e267886e081ae1324e9d08dae3bd1e77fe6f444f7af8

                    SHA512

                    c483f13d8c4db6b182e4e9d0133aebd50c8dc1d6c79aceae9d24d792257a153e1e1dd609a31ba83da48062e34c227697fd35c298858b6b2ae9bb18595d9f6882

                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

                    Filesize

                    16B

                    MD5

                    6752a1d65b201c13b62ea44016eb221f

                    SHA1

                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                    SHA256

                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                    SHA512

                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                  • C:\Users\Admin\AppData\Local\Temp\Tar2313.tmp

                    Filesize

                    161KB

                    MD5

                    be2bec6e8c5653136d3e72fe53c98aa3

                    SHA1

                    a8182d6db17c14671c3d5766c72e58d87c0810de

                    SHA256

                    1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

                    SHA512

                    0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

                  • \??\pipe\crashpad_916_MKKIDYDSQCUAAGNS

                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                  • memory/1784-180-0x0000000077270000-0x0000000077271000-memory.dmp

                    Filesize

                    4KB

                  • memory/1784-127-0x0000000000060000-0x0000000000061000-memory.dmp

                    Filesize

                    4KB