Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05-01-2024 03:28
Behavioral task
behavioral1
Sample
b91097bff5f741a965eb80edfcc97b0b.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
b91097bff5f741a965eb80edfcc97b0b.exe
-
Size
3.5MB
-
MD5
b91097bff5f741a965eb80edfcc97b0b
-
SHA1
fdebe47b69442a312c1008c7a5ee71b3f41b4a68
-
SHA256
de4da24486f406177afea313e60468918398dbbdb3551a7290a4050966494728
-
SHA512
21b96d15a463a5cdc7e2016a8a1e1cf636b1c4d13343f66fdcad24deecba56a29797600701ac3a382133ca585c89eb81fab085853991c19ccf245ff11de91514
-
SSDEEP
49152:JAdGB73ejP3+EMfRdASVaAvrC5Xh602+:JAgR3epMjASHch
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI b91097bff5f741a965eb80edfcc97b0b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\tab_off.gif b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyMergeLetter.dotx b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ClassicPhotoAlbum.potx b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18222_.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14982_.GIF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\month.png b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_left.png b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18214_.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21328_.GIF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupicons.jpg b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SHAREPOINTPROVIDER.DLL b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Hand Prints.htm b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\LEVEL.INF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR30B.GIF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00795_.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186362.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187847.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00289_.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR13F.GIF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Comments.accdt b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\STUBBY1.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\ICE.ELM b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\THMBNAIL.PNG b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\TAB_ON.GIF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15277_.GIF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196364.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PRRT.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00183_.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\CASCADE.ELM b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00011_.WMF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR38F.GIF b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Right.accdt b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ACCDDSUI.DLL b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PROGRAM.DPV b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html b91097bff5f741a965eb80edfcc97b0b.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\common.luac b91097bff5f741a965eb80edfcc97b0b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2560 b91097bff5f741a965eb80edfcc97b0b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2816 vssvc.exe Token: SeRestorePrivilege 2816 vssvc.exe Token: SeAuditPrivilege 2816 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b91097bff5f741a965eb80edfcc97b0b.exe"C:\Users\Admin\AppData\Local\Temp\b91097bff5f741a965eb80edfcc97b0b.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2560
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816