Analysis
-
max time kernel
31s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-04-2023 00:15
Behavioral task
behavioral1
Sample
0x000900000002313f-1838.exe
Resource
win7-20230220-en
General
-
Target
0x000900000002313f-1838.exe
-
Size
3.1MB
-
MD5
17f5da38b24f536ff81aec383e40dc93
-
SHA1
9ee6c50dfd7ca007d9926652c3117f6e1c3283d6
-
SHA256
de3c7ba6254b2826f3a9082db334cb2e5fb60fc233394e8fa8bc2764313ce994
-
SHA512
28333b3f98809e7a25234b0f435a44933615a894ecf3031c945324b2e15d6a9959a2644f451fbaa82edb59242c64b0476581b874578a2fa6811b4e964376ea69
-
SSDEEP
49152:fl1282ocAo1d9iwS2mO13df5k6N21D5MVKPba4SLt6k1Ur3U:fffhcZ9hS2mqaSir3U
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1000 powershell.exe 1176 powershell.exe 1800 powershell.exe 2036 powershell.exe 588 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 1944 WMIC.exe Token: SeSecurityPrivilege 1944 WMIC.exe Token: SeTakeOwnershipPrivilege 1944 WMIC.exe Token: SeLoadDriverPrivilege 1944 WMIC.exe Token: SeSystemProfilePrivilege 1944 WMIC.exe Token: SeSystemtimePrivilege 1944 WMIC.exe Token: SeProfSingleProcessPrivilege 1944 WMIC.exe Token: SeIncBasePriorityPrivilege 1944 WMIC.exe Token: SeCreatePagefilePrivilege 1944 WMIC.exe Token: SeBackupPrivilege 1944 WMIC.exe Token: SeRestorePrivilege 1944 WMIC.exe Token: SeShutdownPrivilege 1944 WMIC.exe Token: SeDebugPrivilege 1944 WMIC.exe Token: SeSystemEnvironmentPrivilege 1944 WMIC.exe Token: SeRemoteShutdownPrivilege 1944 WMIC.exe Token: SeUndockPrivilege 1944 WMIC.exe Token: SeManageVolumePrivilege 1944 WMIC.exe Token: 33 1944 WMIC.exe Token: 34 1944 WMIC.exe Token: 35 1944 WMIC.exe Token: SeIncreaseQuotaPrivilege 1944 WMIC.exe Token: SeSecurityPrivilege 1944 WMIC.exe Token: SeTakeOwnershipPrivilege 1944 WMIC.exe Token: SeLoadDriverPrivilege 1944 WMIC.exe Token: SeSystemProfilePrivilege 1944 WMIC.exe Token: SeSystemtimePrivilege 1944 WMIC.exe Token: SeProfSingleProcessPrivilege 1944 WMIC.exe Token: SeIncBasePriorityPrivilege 1944 WMIC.exe Token: SeCreatePagefilePrivilege 1944 WMIC.exe Token: SeBackupPrivilege 1944 WMIC.exe Token: SeRestorePrivilege 1944 WMIC.exe Token: SeShutdownPrivilege 1944 WMIC.exe Token: SeDebugPrivilege 1944 WMIC.exe Token: SeSystemEnvironmentPrivilege 1944 WMIC.exe Token: SeRemoteShutdownPrivilege 1944 WMIC.exe Token: SeUndockPrivilege 1944 WMIC.exe Token: SeManageVolumePrivilege 1944 WMIC.exe Token: 33 1944 WMIC.exe Token: 34 1944 WMIC.exe Token: 35 1944 WMIC.exe Token: SeIncreaseQuotaPrivilege 1672 wmic.exe Token: SeSecurityPrivilege 1672 wmic.exe Token: SeTakeOwnershipPrivilege 1672 wmic.exe Token: SeLoadDriverPrivilege 1672 wmic.exe Token: SeSystemProfilePrivilege 1672 wmic.exe Token: SeSystemtimePrivilege 1672 wmic.exe Token: SeProfSingleProcessPrivilege 1672 wmic.exe Token: SeIncBasePriorityPrivilege 1672 wmic.exe Token: SeCreatePagefilePrivilege 1672 wmic.exe Token: SeBackupPrivilege 1672 wmic.exe Token: SeRestorePrivilege 1672 wmic.exe Token: SeShutdownPrivilege 1672 wmic.exe Token: SeDebugPrivilege 1672 wmic.exe Token: SeSystemEnvironmentPrivilege 1672 wmic.exe Token: SeRemoteShutdownPrivilege 1672 wmic.exe Token: SeUndockPrivilege 1672 wmic.exe Token: SeManageVolumePrivilege 1672 wmic.exe Token: 33 1672 wmic.exe Token: 34 1672 wmic.exe Token: 35 1672 wmic.exe Token: SeIncreaseQuotaPrivilege 1672 wmic.exe Token: SeSecurityPrivilege 1672 wmic.exe Token: SeTakeOwnershipPrivilege 1672 wmic.exe Token: SeLoadDriverPrivilege 1672 wmic.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
0x000900000002313f-1838.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1948 wrote to memory of 1704 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 1704 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 1704 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 1704 1948 0x000900000002313f-1838.exe cmd.exe PID 1704 wrote to memory of 1944 1704 cmd.exe WMIC.exe PID 1704 wrote to memory of 1944 1704 cmd.exe WMIC.exe PID 1704 wrote to memory of 1944 1704 cmd.exe WMIC.exe PID 1704 wrote to memory of 1944 1704 cmd.exe WMIC.exe PID 1948 wrote to memory of 1672 1948 0x000900000002313f-1838.exe wmic.exe PID 1948 wrote to memory of 1672 1948 0x000900000002313f-1838.exe wmic.exe PID 1948 wrote to memory of 1672 1948 0x000900000002313f-1838.exe wmic.exe PID 1948 wrote to memory of 1672 1948 0x000900000002313f-1838.exe wmic.exe PID 1948 wrote to memory of 1844 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 1844 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 1844 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 1844 1948 0x000900000002313f-1838.exe cmd.exe PID 1844 wrote to memory of 1292 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 1292 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 1292 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 1292 1844 cmd.exe WMIC.exe PID 1948 wrote to memory of 604 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 604 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 604 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 604 1948 0x000900000002313f-1838.exe cmd.exe PID 604 wrote to memory of 880 604 cmd.exe WMIC.exe PID 604 wrote to memory of 880 604 cmd.exe WMIC.exe PID 604 wrote to memory of 880 604 cmd.exe WMIC.exe PID 604 wrote to memory of 880 604 cmd.exe WMIC.exe PID 1948 wrote to memory of 1500 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 1500 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 1500 1948 0x000900000002313f-1838.exe cmd.exe PID 1948 wrote to memory of 1500 1948 0x000900000002313f-1838.exe cmd.exe PID 1500 wrote to memory of 1920 1500 cmd.exe systeminfo.exe PID 1500 wrote to memory of 1920 1500 cmd.exe systeminfo.exe PID 1500 wrote to memory of 1920 1500 cmd.exe systeminfo.exe PID 1500 wrote to memory of 1920 1500 cmd.exe systeminfo.exe PID 1948 wrote to memory of 1000 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1000 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1000 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1000 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1176 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1176 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1176 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1176 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1800 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1800 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1800 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 1800 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 2036 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 2036 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 2036 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 2036 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 588 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 588 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 588 1948 0x000900000002313f-1838.exe powershell.exe PID 1948 wrote to memory of 588 1948 0x000900000002313f-1838.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000900000002313f-1838.exe"C:\Users\Admin\AppData\Local\Temp\0x000900000002313f-1838.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "wmic csproduct get uuid"2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672 -
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1292
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:880
-
C:\Windows\SysWOW64\cmd.execmd "/c " systeminfo2⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:1920 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\XVlBzgbaiC\""2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1000 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History\" \"C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHc\""2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\tcuAxhxKQFDaFpL\""2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1800 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFf\""2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2036 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\RsWxPLDnJObCsNV\""2⤵
- Suspicious behavior: EnumeratesProcesses
PID:588
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHcFilesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\Local\Temp\RsWxPLDnJObCsNVFilesize
71KB
MD56082dd13ad8102d17f9db9cd07600e97
SHA139becc88cea914d843b3c5521038907f2f2f4e71
SHA25640a3f938c8c1eb929771c444d5f8887c42c7cde6281690e2071a2593ba92e48a
SHA512b7d5c716b6339b3138492c8b0cf4c9540a8d8224f9d5e72e34ceab442bdfa9c855473bbed68a489851f019461e1b1f9d86baf067be556c67b948c930899d3c1e
-
C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFfFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tcuAxhxKQFDaFpLFilesize
71KB
MD56082dd13ad8102d17f9db9cd07600e97
SHA139becc88cea914d843b3c5521038907f2f2f4e71
SHA25640a3f938c8c1eb929771c444d5f8887c42c7cde6281690e2071a2593ba92e48a
SHA512b7d5c716b6339b3138492c8b0cf4c9540a8d8224f9d5e72e34ceab442bdfa9c855473bbed68a489851f019461e1b1f9d86baf067be556c67b948c930899d3c1e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W7GLXQ359BC4M5911FAR.tempFilesize
7KB
MD5f57a4a7ac4fba923abfc7044953e47cc
SHA1e9575b37e2ad775535adf4033f51b90cc4e4313d
SHA2561751ea41f92db2e10dc30d1b9ff10af6b81cca23b5ee0d087f1dbd7cc5dc24dc
SHA512e2f904c18ea08035f2acf3fa2e044b656465f829b60df8f26378249098633a40c308e80702b69ad03dbdadc70ff5eabe0e70bd60d69f35d11db98cfc82b306e4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5f57a4a7ac4fba923abfc7044953e47cc
SHA1e9575b37e2ad775535adf4033f51b90cc4e4313d
SHA2561751ea41f92db2e10dc30d1b9ff10af6b81cca23b5ee0d087f1dbd7cc5dc24dc
SHA512e2f904c18ea08035f2acf3fa2e044b656465f829b60df8f26378249098633a40c308e80702b69ad03dbdadc70ff5eabe0e70bd60d69f35d11db98cfc82b306e4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5f57a4a7ac4fba923abfc7044953e47cc
SHA1e9575b37e2ad775535adf4033f51b90cc4e4313d
SHA2561751ea41f92db2e10dc30d1b9ff10af6b81cca23b5ee0d087f1dbd7cc5dc24dc
SHA512e2f904c18ea08035f2acf3fa2e044b656465f829b60df8f26378249098633a40c308e80702b69ad03dbdadc70ff5eabe0e70bd60d69f35d11db98cfc82b306e4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5f57a4a7ac4fba923abfc7044953e47cc
SHA1e9575b37e2ad775535adf4033f51b90cc4e4313d
SHA2561751ea41f92db2e10dc30d1b9ff10af6b81cca23b5ee0d087f1dbd7cc5dc24dc
SHA512e2f904c18ea08035f2acf3fa2e044b656465f829b60df8f26378249098633a40c308e80702b69ad03dbdadc70ff5eabe0e70bd60d69f35d11db98cfc82b306e4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5f57a4a7ac4fba923abfc7044953e47cc
SHA1e9575b37e2ad775535adf4033f51b90cc4e4313d
SHA2561751ea41f92db2e10dc30d1b9ff10af6b81cca23b5ee0d087f1dbd7cc5dc24dc
SHA512e2f904c18ea08035f2acf3fa2e044b656465f829b60df8f26378249098633a40c308e80702b69ad03dbdadc70ff5eabe0e70bd60d69f35d11db98cfc82b306e4
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1000-56-0x0000000002500000-0x0000000002540000-memory.dmpFilesize
256KB
-
memory/1000-57-0x0000000002500000-0x0000000002540000-memory.dmpFilesize
256KB