Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
07-12-2024 19:03
Behavioral task
behavioral1
Sample
40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe
Resource
win7-20241023-en
windows7-x64
5 signatures
150 seconds
General
-
Target
40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe
-
Size
145KB
-
MD5
5de05a7718e617eb0556a44bee7d10b3
-
SHA1
89e382bb8bf399d5184f4f2d2688551176404108
-
SHA256
40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999
-
SHA512
f77174bb59c337ec05de875942d29a634eced589fbde1be3ddf64a058f5e0681ec52819ba2c5ccab38a47c6fb9bb32d8a80d95718a8b1fb784e430de51f8bd8c
-
SSDEEP
1536:qzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD+9eKvnVVIOjaav162DgWLKXIGB:ZqJogYkcSNm9V7DeeELLaav1n1W4sT
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeDebugPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: 36 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeImpersonatePrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeIncBasePriorityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeIncreaseQuotaPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: 33 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeManageVolumePrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeProfSingleProcessPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeRestorePrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSystemProfilePrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeTakeOwnershipPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeShutdownPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeSecurityPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe Token: SeBackupPrivilege 2064 40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe"C:\Users\Admin\AppData\Local\Temp\40b6755a3666ffe5ef76de7bf56064dbe4034d90ec0ce762b173c7db2ca64999.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5e2d36ac1a36a8ba5dedf08ab45e7312f
SHA1513e01429db01fbdc5000f1639f41c252e40f2b2
SHA2568cc3d482f5fa9de95b7e6a075721367df197bc96641b2165e68251ac437ec103
SHA512ae27f1335b547cb3d787784f403b2f1c0835f219fd27e52897638b9e75cb0e3b8754c0d0782e949ee5c97ddf0d2ff8dd0e7368613d7da6269df3bfa73c182982
-
Filesize
422B
MD54843526ef03ff7547ad2804cc9bdc1ca
SHA1447c776f5222db991177c8bb583ac2c0fb3d5acb
SHA256e3b77d10faab96d26c0d54900b581e9dab04c8623e39a01f003469f56b07d5c6
SHA51219962dbc7f190c35b5854a798b11551a9c354b424ce7039240415dd3720e8edeba342bd7a848ed15d0b5fd747c4749525fe3ab8e2e135d68bebf7b3700cc6aeb
-
Filesize
129B
MD507283ee9a1852ef1f3c6337bf36b9012
SHA1566f9d7912b14e2d960baf84350c0ed3a41f9999
SHA256a862c5bb3a35b2662fd8baa4a0e1cc92c411ef0ca122a9ebfc8baa0828f85314
SHA5126c9fbba9051be6189fe2901c07f3c98b4ea89e619c444ea14a4b71c8f04f45b8078f6429807b122e80b09561a37253be4d9c934c72b4e1a40c712a811ff0fdf8