94f79307cf406166058b66af4ef21d3eb58051b1d1dd0ec793e5406fc59fb7e8

Analysis

max time kernel
48s
max time network
57s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
10-04-2023 14:58

Target

94f79307cf406166058b66af4ef21d3eb58051b1d1dd0ec793e5406fc59fb7e8.exe
Size

37KB
MD5

4f0402bf30445ece92c85cd3ee8240ac
SHA1

26d327332540b1bbe091db0f7e2345a1295ae271
SHA256

94f79307cf406166058b66af4ef21d3eb58051b1d1dd0ec793e5406fc59fb7e8
SHA512

a43cee4c53bc87d1507455b00350b5fcf0ccf64bf0a615b1215e163cd0899eace9906f80d61583ef65fa38669bbf93f5af71948080abe8047cab5950d5914396
SSDEEP

768:qz5oDHOiKsJOqee51+SJ5K1BbDUZLxilVHSc0m/pWtHWpHWXBZlLBB1DezPmE/nz:qz5ziKsJOqeov4bDQOxQbeRz

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5076 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

94f79307cf406166058b66af4ef21d3eb58051b1d1dd0ec793e5406fc59fb7e8.exe

description pid process

Token: SeDebugPrivilege 2060 94f79307cf406166058b66af4ef21d3eb58051b1d1dd0ec793e5406fc59fb7e8.exe

flow	ioc
1	ip-api.com

pid	process
5076	PING.EXE

description	pid	process
Token: SeDebugPrivilege	2060	94f79307cf406166058b66af4ef21d3eb58051b1d1dd0ec793e5406fc59fb7e8.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

94f79307cf406166058b66af4ef21d3eb58051b1d1dd0ec793e5406fc59fb7e8.execmd.exe

description	pid	process	target process
PID 2060 wrote to memory of 2676	2060	94f79307cf406166058b66af4ef21d3eb58051b1d1dd0ec793e5406fc59fb7e8.exe	cmd.exe
PID 2060 wrote to memory of 2676	2060	94f79307cf406166058b66af4ef21d3eb58051b1d1dd0ec793e5406fc59fb7e8.exe	cmd.exe
PID 2676 wrote to memory of 3152	2676	cmd.exe	chcp.com
PID 2676 wrote to memory of 3152	2676	cmd.exe	chcp.com
PID 2676 wrote to memory of 5076	2676	cmd.exe	PING.EXE
PID 2676 wrote to memory of 5076	2676	cmd.exe	PING.EXE

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/2060-121-0x0000013AA3E90000-0x0000013AA3EA0000-memory.dmp

Filesize
64KB

Download
memory/2060-122-0x0000013AA4250000-0x0000013AA4260000-memory.dmp

Filesize
64KB

Download
memory/2060-123-0x0000013ABE540000-0x0000013ABE590000-memory.dmp

Filesize
320KB

Download