Analysis
- max time kernel
168s - max time network
182s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system - submitted
21/03/2023, 14:45
Behavioral task
behavioral1
Sample
1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe
Resource
win7-20230220-en
windows7-x64
12 signatures
150 seconds
General
- Target 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe
- Size 1.4MB
- Sample230321-r44vesbe25
- SHA256 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647
- MD5 d4d4cb476eade986dc64a498bf4eb281
- SHA1 f4201c93693f78fe4c9c0233e1b480a1b4d42d58
- SHA512 6a898f53680f29df522738018fdccc26ce554e11ac958045bae88d66ed0d7c7440f601eb0fbd76f178e3746f5930c9ac4119f3e2bc0a9cabc6f838a8761d863c
- SSDEEP 24576:UGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRXu5htS0:fpEUIvU0N9jkpjweXt77+575
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe File opened for modification C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
pid Process 2728 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeAssignPrimaryTokenPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeLockMemoryPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeIncreaseQuotaPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeMachineAccountPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeTcbPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeSecurityPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeTakeOwnershipPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeLoadDriverPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeSystemProfilePrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeSystemtimePrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeProfSingleProcessPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeIncBasePriorityPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeCreatePagefilePrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeCreatePermanentPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeBackupPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeRestorePrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeShutdownPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeDebugPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeAuditPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeSystemEnvironmentPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeChangeNotifyPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeRemoteShutdownPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeUndockPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeSyncAgentPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeEnableDelegationPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeManageVolumePrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeImpersonatePrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeCreateGlobalPrivilege 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: 31 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: 32 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: 33 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: 34 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: 35 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe Token: SeDebugPrivilege 2728 taskkill.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2684 wrote to memory of 3996 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe 86 PID 2684 wrote to memory of 3996 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe 86 PID 2684 wrote to memory of 3996 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe 86 PID 3996 wrote to memory of 2728 3996 cmd.exe 90 PID 3996 wrote to memory of 2728 3996 cmd.exe 90 PID 3996 wrote to memory of 2728 3996 cmd.exe 90 PID 2684 wrote to memory of 1672 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe 91 PID 2684 wrote to memory of 1672 2684 1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe 91 PID 1672 wrote to memory of 4668 1672 chrome.exe 92 PID 1672 wrote to memory of 4668 1672 chrome.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe"C:\Users\Admin\AppData\Local\Temp\1dc1b761af5d1d62a213f477f5a05b6a5e6a5395a2a401a2ea48ad59bc6bb647.exe"1⤵
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd6cb9758,0x7ffcd6cb9768,0x7ffcd6cb97783⤵PID:4668
-
-