ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed

Analysis

max time kernel
113s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-05-2023 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
Size

123KB
MD5

c50a968d1c6351e9e087a56b1e5a1acd
SHA1

d9c4742a26bf41c5009f2e56f53ae9fab931a5b1
SHA256

ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed
SHA512

a98ff57f8246de2a0f9293559e5a4d34853a22bd0c85237d6662ecb81356c6466164e7f61345bbb1b31ed09ff61cb464732c5af8bb674601a3ebb6c703d009b7
SSDEEP

3072:wlrwbVaNHJLRnXsJynTQkQhYXzKexgUxTEe8ELcfffffffffU1:6sBaNp1synTQkQhYXzxSUBB9cffffffc

Score

9^/10

evasion persistence ransomware spyware stealer

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
268	bcdedit.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SearchFilterHost = "cmd /c \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe\" --zxcv"	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
592	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
1664	taskkill.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
Token: SeDebugPrivilege	1664	taskkill.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2008	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	28
PID 1276 wrote to memory of 2008	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	28
PID 1276 wrote to memory of 2008	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	28
PID 1276 wrote to memory of 560	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	30
PID 1276 wrote to memory of 560	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	30
PID 1276 wrote to memory of 560	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	30
PID 1276 wrote to memory of 108	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	31
PID 1276 wrote to memory of 108	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	31
PID 1276 wrote to memory of 108	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	31
PID 1276 wrote to memory of 544	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	34
PID 1276 wrote to memory of 544	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	34
PID 1276 wrote to memory of 544	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	34
PID 1276 wrote to memory of 1912	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	32
PID 1276 wrote to memory of 1912	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	32
PID 1276 wrote to memory of 1912	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	32
PID 1276 wrote to memory of 592	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	33
PID 1276 wrote to memory of 592	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	33
PID 1276 wrote to memory of 592	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	33
PID 1276 wrote to memory of 268	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	38
PID 1276 wrote to memory of 268	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	38
PID 1276 wrote to memory of 268	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	38
PID 1276 wrote to memory of 1664	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	43
PID 1276 wrote to memory of 1664	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	43
PID 1276 wrote to memory of 1664	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	43
PID 1276 wrote to memory of 960	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	47
PID 1276 wrote to memory of 960	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	47
PID 1276 wrote to memory of 960	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	47
PID 1276 wrote to memory of 1532	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	46
PID 1276 wrote to memory of 1532	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	46
PID 1276 wrote to memory of 1532	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	46
PID 1276 wrote to memory of 1932	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	49
PID 1276 wrote to memory of 1932	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	49
PID 1276 wrote to memory of 1932	1276	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	49

C:\Users\Admin\AppData\Local\Temp\ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
"C:\Users\Admin\AppData\Local\Temp\ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\CMD.exe
  CMD /C RD %TEMP% /S/Q & MKDIR %TEMP%
  2⤵
  PID:2008
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:560
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:108
- C:\Windows\system32\CMD.exe
  CMD /C %WINDIR%\sysnative\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  PID:1912
- C:\Windows\system32\sc.exe
  sc delete syshost32
  2⤵
  - Launches sc.exe
  PID:592
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:544
- C:\Windows\system32\bcdedit.exe
  bcdedit /set TESTSIGNING OFF
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:268
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msiexec.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" CMD /C DEL /F /S /Q "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.* "
  2⤵
  PID:1532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" CMD /C DEL /F /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.* "
  2⤵
  PID:960
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1932