Analysis

  • max time kernel
    24s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    03-03-2023 15:30

General

  • Target

    18669b21194b03105d0a9145635a1ce6.exe

  • Size

    1.4MB

  • MD5

    18669b21194b03105d0a9145635a1ce6

  • SHA1

    59d361b172cfb610aeef1e0ab6e2546b40aaf1f4

  • SHA256

    d9d2ad004f71ee5e3dc5f0170b74a961fc5df4e187ea03a11788ed30a1a8230a

  • SHA512

    0dff9b45ddbd0a80e05d3194f645a5f38c165ab904e01eb566a1406823c80c78ba0e39e7e81975299951d482ec31cf7514a3c2afd997b2bc656f6cd846be69d8

  • SSDEEP

    24576:PGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRfj5h6SY:OpEUIvU0N9jkpjweXt77L5MF

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18669b21194b03105d0a9145635a1ce6.exe
    "C:\Users\Admin\AppData\Local\Temp\18669b21194b03105d0a9145635a1ce6.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im chrome.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:968
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1136
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6999758,0x7fef6999768,0x7fef6999778
        3⤵
          PID:1620
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1200 --field-trial-handle=1344,i,7343834160291593354,14936113826889111644,131072 /prefetch:2
          3⤵
            PID:1660
      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
        1⤵
          PID:1988

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html

          Filesize

          786B

          MD5

          9ffe618d587a0685d80e9f8bb7d89d39

          SHA1

          8e9cae42c911027aafae56f9b1a16eb8dd7a739c

          SHA256

          a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

          SHA512

          a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png

          Filesize

          6KB

          MD5

          362695f3dd9c02c83039898198484188

          SHA1

          85dcacc66a106feca7a94a42fc43e08c806a0322

          SHA256

          40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca

          SHA512

          a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f

        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js

          Filesize

          3KB

          MD5

          c31f14d9b1b840e4b9c851cbe843fc8f

          SHA1

          205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4

          SHA256

          03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54

          SHA512

          2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa

        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js

          Filesize

          84KB

          MD5

          a09e13ee94d51c524b7e2a728c7d4039

          SHA1

          0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

          SHA256

          160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

          SHA512

          f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json

          Filesize

          1KB

          MD5

          05bfb082915ee2b59a7f32fa3cc79432

          SHA1

          c1acd799ae271bcdde50f30082d25af31c1208c3

          SHA256

          04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1

          SHA512

          6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3

        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\743b4682-2faa-45cb-b61d-b895148b156d.tmp

          Filesize

          4KB

          MD5

          9a4b4986ffc6e4b53764a3a7b98254c2

          SHA1

          47171318aa7dfd6f2cf04b5f9feaf464f5c9d80c

          SHA256

          680751636b907584e9e4519ef5033d18ef4f170bbb457caeec2fd26e9578f19b

          SHA512

          9d09b4e8f4aab302256c9242ff77ed425daa3a2256d42b1eba43dd284f094b79636195558a6738b34f71828f734fb01f33f949503613ca7d9dbf520f7ef263b5

        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

          Filesize

          4KB

          MD5

          67041292f9020d8090a6a66a6b6de615

          SHA1

          4ff9397bf56e4122e5fa89ce3caa6068d4bd5146

          SHA256

          31ac52e2890ecfae26f93b4d3c570ab5ab09372db752004a2e8e7882d4d7b738

          SHA512

          7fd8fbcb3844f7395cbec16f68df33bdaa3c71515f6e07341972aa4863afcd3ebe4dee35638bf086a2f31eddd30222361dc87541de3191fa9377dba1021138ee

        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

          Filesize

          4KB

          MD5

          0a909423b67647466f6a2ac0cfe7e136

          SHA1

          6a10ea69077d01e6125aa079130baf377b6dea18

          SHA256

          b5f34d96b85949ba2941d5f453cbdedbef604d890cb46f5c237a37b613c9d163

          SHA512

          1ccc4e4b73290c6a68781aff84ea8da43f303248291ed29f8846459cd71d09a63f78b48da1168ed0e960eb99dbe090cbee8d17d5dbbc4c472abcec0960c6aaaa

        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

          Filesize

          11KB

          MD5

          a33ceb08b2d14456ffb8f3df87b9aa7c

          SHA1

          9613548af4e91f49ce3a3597135ce82ec498aa17

          SHA256

          6fafeb4e478edd8a009c37c63d0dd6ed3229742914790fb4594eb2a440b5e0b5

          SHA512

          6d58f787cca5b75120729adfdae2a6f625954d298fe5f84d71b63c55588f1b61de96ba5311e3d6958f58d9ca0e57df8c359b99cc521cf9d6be6c9e2906b6194c

        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

          Filesize

          11KB

          MD5

          5fff1742dabfe19ad19b4397db36a16e

          SHA1

          6abdf966d2896376d1659d96d510b1a3604f6f93

          SHA256

          06798591b956eca58687e267886e081ae1324e9d08dae3bd1e77fe6f444f7af8

          SHA512

          c483f13d8c4db6b182e4e9d0133aebd50c8dc1d6c79aceae9d24d792257a153e1e1dd609a31ba83da48062e34c227697fd35c298858b6b2ae9bb18595d9f6882

        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

          Filesize

          16B

          MD5

          6752a1d65b201c13b62ea44016eb221f

          SHA1

          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

          SHA256

          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

          SHA512

          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

        • C:\Users\Admin\AppData\Local\Temp\Cab211B.tmp

          Filesize

          61KB

          MD5

          fc4666cbca561e864e7fdf883a9e6661

          SHA1

          2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

          SHA256

          10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

          SHA512

          c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

        • C:\Users\Admin\AppData\Local\Temp\Tar21E8.tmp

          Filesize

          161KB

          MD5

          73b4b714b42fc9a6aaefd0ae59adb009

          SHA1

          efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

          SHA256

          c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

          SHA512

          73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

        • memory/1660-122-0x0000000000060000-0x0000000000061000-memory.dmp

          Filesize

          4KB