Analysis
-
max time kernel
114s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 20:30
Behavioral task
behavioral1
Sample
de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe
-
Size
3.5MB
-
MD5
b91097bff5f741a965eb80edfcc97b0b
-
SHA1
fdebe47b69442a312c1008c7a5ee71b3f41b4a68
-
SHA256
de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728
-
SHA512
21b96d15a463a5cdc7e2016a8a1e1cf636b1c4d13343f66fdcad24deecba56a29797600701ac3a382133ca585c89eb81fab085853991c19ccf245ff11de91514
-
SSDEEP
49152:JAdGB73ejP3+EMfRdASVaAvrC5Xh602+:JAgR3epMjASHch
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\7-Zip\descript.ion de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\cpu.js de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\cpu.js de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\clock.js de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Toronto de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_rest.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_h.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\drag.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_cloudy.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WPFT632.CNV de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Swift_Current de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Journal\MSPVWCTL.DLL de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\library.js de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_cloudy.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Algiers de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\clock.js de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\Java\jre7\lib\rt.jar de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\JoinProtect.M2T de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1200 de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2824 vssvc.exe Token: SeRestorePrivilege 2824 vssvc.exe Token: SeAuditPrivilege 2824 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe"C:\Users\Admin\AppData\Local\Temp\de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1200
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824