Analysis
- max time kernel
84s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
16/03/2023, 04:36
Behavioral task
behavioral1
Sample
7b08c2efe246690f904eb4f235fad3ac.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
150 seconds
General
- Target 7b08c2efe246690f904eb4f235fad3ac.exe
- Size 89KB
- Sample230316-e78xbsbc7w
- SHA256 5bb1e2f5330e171ee2e38e65c548a04d4c58109325218413e9e4abc43873b8df
- MD5 7b08c2efe246690f904eb4f235fad3ac
- SHA1 711d5077303101f3db5c2fc64dcfee718b3bc15a
- SHA512 2cf708c87094c50c602a5a97745580aae9358eb5b4bdf8bcdb2cbd5e71b059d6726eb23fd6e2848200cb4796097cd292a023f44776046aca2910642d8b1f3910
- SSDEEP 1536:yTz2ZkLGoqTIuW/NxRVcmXR3g4yttAnVi86QOqpCb//hkzbk8t/H+K7wm:yKmLGkVcmh3XOy+//Stt/H+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 7b08c2efe246690f904eb4f235fad3ac.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 7b08c2efe246690f904eb4f235fad3ac.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeTcbPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeChangeNotifyPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeCreateTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeBackupPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeRestorePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeIncreaseQuotaPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeAssignPrimaryTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeImpersonatePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeTcbPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeChangeNotifyPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeCreateTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeBackupPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeRestorePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeIncreaseQuotaPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeAssignPrimaryTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeImpersonatePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeTcbPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeChangeNotifyPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeCreateTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeBackupPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeRestorePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeIncreaseQuotaPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeAssignPrimaryTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeImpersonatePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeTcbPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeChangeNotifyPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeCreateTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeBackupPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeRestorePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeIncreaseQuotaPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeAssignPrimaryTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeImpersonatePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeTcbPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeChangeNotifyPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeCreateTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeBackupPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeRestorePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeIncreaseQuotaPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeAssignPrimaryTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeImpersonatePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeTcbPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeChangeNotifyPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeCreateTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeBackupPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeRestorePrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeIncreaseQuotaPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe Token: SeAssignPrimaryTokenPrivilege 840 7b08c2efe246690f904eb4f235fad3ac.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 7b08c2efe246690f904eb4f235fad3ac.exe