Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2024 23:29
Behavioral task
behavioral1
Sample
444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
General
-
Target
444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
-
Size
978KB
-
MD5
34371c7833c38fa441316f238961d9a2
-
SHA1
74e99094f77642ef2d803188121a9c61e73139fe
-
SHA256
444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105
-
SHA512
aba20341168f6f78cecb302c1544ad617a6dc4d5e081cb3ffbcfe0e67c9a5708ce7e9d264de78eb620c3acea19cf37789f25a48dbb080ed16542ccc4b780386a
-
SSDEEP
24576:VoyOrimyU/MAYycTwgadEhiU8BnM4XkEJ:CNyU/LYyQwdU8RkE
Malware Config
Signatures
-
Zebrocy Go Variant 6 IoCs
resource yara_rule behavioral2/memory/3328-1-0x0000000000400000-0x00000000007A7000-memory.dmp Zebrocy behavioral2/memory/3328-2-0x0000000000400000-0x00000000007A7000-memory.dmp Zebrocy behavioral2/memory/3328-2323-0x0000000000400000-0x00000000007A7000-memory.dmp Zebrocy behavioral2/memory/3328-3724-0x0000000000400000-0x00000000007A7000-memory.dmp Zebrocy behavioral2/memory/3328-8171-0x0000000000400000-0x00000000007A7000-memory.dmp Zebrocy behavioral2/memory/3328-16330-0x0000000000400000-0x00000000007A7000-memory.dmp Zebrocy -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3328-0-0x0000000000400000-0x00000000007A7000-memory.dmp upx behavioral2/memory/3328-1-0x0000000000400000-0x00000000007A7000-memory.dmp upx behavioral2/memory/3328-2-0x0000000000400000-0x00000000007A7000-memory.dmp upx behavioral2/memory/3328-2323-0x0000000000400000-0x00000000007A7000-memory.dmp upx behavioral2/memory/3328-3724-0x0000000000400000-0x00000000007A7000-memory.dmp upx behavioral2/memory/3328-8171-0x0000000000400000-0x00000000007A7000-memory.dmp upx behavioral2/memory/3328-16330-0x0000000000400000-0x00000000007A7000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\icudtl.dat.DATA 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\LargeTile.scale-200.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\main.css 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-200.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-200.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-100.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Logo.scale-100_contrast-white.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\mso.acl 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-unplated.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle_2x.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\plugin.js 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Java\jre-1.8\COPYRIGHT 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\progress.gif 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-150.HCBlack.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\Shaders\LoadedModelShaders\Platform.hlsl 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\StandardShader.ps.cso 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\ui-strings.js 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\PREVIEW.GIF 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileMediumSquare.scale-200.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-200.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\pages\winrthost.htm 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated_contrast-white.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-MX\View3d\3DViewerProductDescription-universal.xml 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Call_Ringing.m4a 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-unplated_contrast-white.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-48.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Third Party Notices.txt 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\ui-strings.js 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\PREVIEW.GIF 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle.cur 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Square150x150Logo.scale-100.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-64.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-125.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7dd.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\ICE.INF 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-400.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileSmallSquare.scale-200.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-200.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\ui-strings.js 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ui-strings.js 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36_contrast-black.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsStoreLogo.scale-200.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\license.txt 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\PREVIEW.GIF 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-200_contrast-black.png 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3328 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe 3328 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1912 vssvc.exe Token: SeRestorePrivilege 1912 vssvc.exe Token: SeAuditPrivilege 1912 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe"C:\Users\Admin\AppData\Local\Temp\444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3328
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912