Analysis
- max time kernel
133s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
25/06/2024, 23:23
Behavioral task
behavioral1
Sample
1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
General
- Target 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe
- Size 6.3MB
- Sample240625-3c86lszenc
- SHA256 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b
- MD5 027c39c3fdeac093022bbb41e5c1e03e
- SHA1 c81cf9fac31f79261b848243b02cd124974ca6c5
- SHA512 c27e74e0eb6aef8bfb949f6e3d030ec0ad968a6e4fa0a92d893f9ee523bd72e0d997bb6bdbd17c47d5d2bf680dec3aa8cf578067bc957e85980a00ee7dd4ad12
- SSDEEP 196608:LKS2Vqqp+/UurGTGcej5wU7420mSZH5IC2ZDc3P:Pojp+9aTGcelwU7bUeC2K3P
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 376 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3064-0-0x0000000000400000-0x0000000001352000-memory.dmp upx behavioral2/memory/3064-2-0x0000000000400000-0x0000000001352000-memory.dmp upx behavioral2/memory/3064-41-0x0000000000400000-0x0000000001352000-memory.dmp upx behavioral2/files/0x000d00000002348f-44.dat upx behavioral2/memory/376-47-0x0000000000400000-0x0000000001352000-memory.dmp upx behavioral2/memory/376-87-0x0000000000400000-0x0000000001352000-memory.dmp upx - Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
flow ioc 28 http://www.toplxtx.com/image/index_note.htm - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\IESettingSync 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\IESettingSync 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 4788 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe Token: SeDebugPrivilege 376 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 376 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 376 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 376 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 376 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3064 wrote to memory of 376 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 95 PID 3064 wrote to memory of 376 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 95 PID 3064 wrote to memory of 376 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 95 PID 3064 wrote to memory of 3872 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 96 PID 3064 wrote to memory of 3872 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 96 PID 3064 wrote to memory of 3872 3064 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe 96 PID 3872 wrote to memory of 4788 3872 cmd.exe 98 PID 3872 wrote to memory of 4788 3872 cmd.exe 98 PID 3872 wrote to memory of 4788 3872 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe"C:\Users\Admin\AppData\Local\Temp\1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe"1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exeC:\Users\Admin\1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:376
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 2 &del "C:\Users\Admin\AppData\Local\Temp\1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:4788
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b.exe
- Size 6.3MB
- SHA256 1842f39b86e1754ebe33d6c399227d6e1dd48b1253508a2cf86ba15d53f44b8b
- MD5 027c39c3fdeac093022bbb41e5c1e03e
- SHA1 c81cf9fac31f79261b848243b02cd124974ca6c5
- SHA512 c27e74e0eb6aef8bfb949f6e3d030ec0ad968a6e4fa0a92d893f9ee523bd72e0d997bb6bdbd17c47d5d2bf680dec3aa8cf578067bc957e85980a00ee7dd4ad12
- SSDEEP 196608:LKS2Vqqp+/UurGTGcej5wU7420mSZH5IC2ZDc3P:Pojp+9aTGcelwU7bUeC2K3P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\link[1].htm
- Size 1KB
- SHA256 b2b7e0b689ceff4b9c78766dee2e82806d11e1e534dc46ebf4c07aba6db47ed1
- MD5 e4eefdfdea28a5637f2f2abaeb563bbe
- SHA1 4467d0af788b232ff534551b9c877e6aa737a44b
- SHA512 9fb784f02f2db57038e75e6810dae46e46d22e61fa347ac8f36cb23a55e25cab7e3647402a38dac38082e6531352bd37ec1483bd89c626160ad5992098589bbb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\e57f637.tmp
- Size 1.6MB
- SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
- MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
- SHA1 e16506f662dc92023bf82def1d621497c8ab5890
- SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
- SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\e57f638.tmp
- Size 1.6MB
- SHA256 5a7dac8c8b5d7cf1115246dfaf994e7f50e16a7eac1488642396f5e23fddfe0d
- MD5 5870ea0d6ba8dd6e2008466bdd00e0f4
- SHA1 d41bf60d0dedff90e3cfc1b41b7e1a73df39a7d5
- SHA512 0c620d5e7383adcf979feccc3b1bad584a5cec8b3d74d0ace8bb786f1f04ba87fa70d59d041dc3833977d44a75f2070181d4054c7c0b9c4ce2d66249b4b3c837
- SSDEEP 24576:qUmNLa3/ciWUl/O9NullShqmJJBwuCx59U4IgL5p33l:CgrWUl2ruLIJBwuOTU4Iwl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\e57f639.tmp
- Size 137KB
- SHA256 5dd2f5a957946e0b6f63660ebd897851aad4795d4c847396c47ddbb647715583
- MD5 f6b847a54cfb804a25b8842b45fd1d50
- SHA1 bb22fef07ce1577c8a7fa057d8cf05502c013bfc
- SHA512 dd08a55f538e2a33e6a0c496dc97ae9045594cbbf62f7894ae8ded63f4dc0b2e89c5935269adfd1c19607b1d2474bddc49f6acb955e6dc53a55560663ca2137a
- SSDEEP 3072:Jzo8B8bfB1A9eZ6UACyOBwr1of+S/M19oWUrTv5ZXYuDjU+E:hB8bp1UehAj1of+SDav
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wn.ini
- Size 753B
- SHA256 6599ca633c004ffaa846c0a34ad4e6f1f2b28d75b0ec3bb57e2cdd1c087030ff
- MD5 6686dca6a9a11a388d213eb43397354e
- SHA1 746cb7e8ef122e1b4db751634dd68f98273d6217
- SHA512 a66ebab93acab65804fc8a7dbcfcb3aa5a41dd912feee4f8bfd389f4fb7cd81b06ae50665b1b7aa418f68ef7bad168984b4e7d5e37a3e0cf40ebbe5d05413cdd
- MD5 SHA1 SHA512