Analysis
- max time kernel
127s - max time network
143s - platform
windows10_x64 - resource
win10v200430 - submitted
02/07/2020, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
944e549ba4db11ea3f94a2873ffbe693.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
944e549ba4db11ea3f94a2873ffbe693.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target 944e549ba4db11ea3f94a2873ffbe693.exe
- Size 836KB
- Sample200702-eb97h33hh6
- SHA256 a486d1f0ad1fb2729dbbcd5d3606f30566f86abd3f2d5218c11077dfeac95f0e
- MD5 944e549ba4db11ea3f94a2873ffbe693
- SHA1 c72eed628c38740d753e823f96873b0eedcbbd50
- SHA512 1aa1492996f6546c693e66857adfe3d4b771aeb8b6923881f799c17aa86bcd9dac16bf55234335800b04a9a7df7ba6f578d00eeee52dcfe263c83ceee4e9d14d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
-
raccoon
Ransom Note
- [Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Tue Jun 23 14:23:14 2020 Launched at: 2020.07.02 - 09:28:36 GMT Bot_ID: 3E009A64-65D7-465C-9098-F2673DD3F416_Admin Running on a desktop =R=A=C=C=O=O=N= System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.13 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: OWZMOTQA - Username: Admin - Windows version: NT 10.0 - Product name: Windows 10 Pro - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 4095 MB (703 MB used) - Screen resolution: 1280x720 - Display devices: 0) Microsoft Basic Display Adapter ============
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
yara_rule raccoon_log_file - Delays execution with timeout.exe 1 IoCs
pid Process 3408 timeout.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeRestorePrivilege 2208 WerFault.exe Token: SeBackupPrivilege 2208 WerFault.exe Token: SeRestorePrivilege 2224 WerFault.exe Token: SeBackupPrivilege 2224 WerFault.exe Token: SeRestorePrivilege 3040 WerFault.exe Token: SeBackupPrivilege 3040 WerFault.exe Token: SeBackupPrivilege 3040 WerFault.exe Token: SeDebugPrivilege 3040 WerFault.exe Token: SeDebugPrivilege 2224 WerFault.exe Token: SeDebugPrivilege 2208 WerFault.exe - Executes dropped EXE 4 IoCs
pid Process 2752 p7TeggIuO7.exe 3592 meOcgKwHrM.exe 3964 Px9Bx9qrFZ.exe 3800 2bLJ9qxwLq.exe - Program crash 3 IoCs
pid pid_target Process procid_target 3040 3964 WerFault.exe 75 2224 3800 WerFault.exe 76 2208 3592 WerFault.exe 74 - Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\LocalLow\cr6im03b56g32r\desktop.ini 944e549ba4db11ea3f94a2873ffbe693.exe - Enumerates connected drives 3 TTPs
- Suspicious use of WriteProcessMemory 137 IoCs
description pid Process procid_target PID 1516 wrote to memory of 1892 1516 944e549ba4db11ea3f94a2873ffbe693.exe 72 PID 1516 wrote to memory of 1892 1516 944e549ba4db11ea3f94a2873ffbe693.exe 72 PID 1516 wrote to memory of 1892 1516 944e549ba4db11ea3f94a2873ffbe693.exe 72 PID 1516 wrote to memory of 1892 1516 944e549ba4db11ea3f94a2873ffbe693.exe 72 PID 1516 wrote to memory of 1892 1516 944e549ba4db11ea3f94a2873ffbe693.exe 72 PID 1516 wrote to memory of 1892 1516 944e549ba4db11ea3f94a2873ffbe693.exe 72 PID 1516 wrote to memory of 1892 1516 944e549ba4db11ea3f94a2873ffbe693.exe 72 PID 1516 wrote to memory of 1892 1516 944e549ba4db11ea3f94a2873ffbe693.exe 72 PID 1516 wrote to memory of 1892 1516 944e549ba4db11ea3f94a2873ffbe693.exe 72 PID 1892 wrote to memory of 2752 1892 944e549ba4db11ea3f94a2873ffbe693.exe 73 PID 1892 wrote to memory of 2752 1892 944e549ba4db11ea3f94a2873ffbe693.exe 73 PID 1892 wrote to memory of 2752 1892 944e549ba4db11ea3f94a2873ffbe693.exe 73 PID 1892 wrote to memory of 3592 1892 944e549ba4db11ea3f94a2873ffbe693.exe 74 PID 1892 wrote to memory of 3592 1892 944e549ba4db11ea3f94a2873ffbe693.exe 74 PID 1892 wrote to memory of 3592 1892 944e549ba4db11ea3f94a2873ffbe693.exe 74 PID 1892 wrote to memory of 3964 1892 944e549ba4db11ea3f94a2873ffbe693.exe 75 PID 1892 wrote to memory of 3964 1892 944e549ba4db11ea3f94a2873ffbe693.exe 75 PID 1892 wrote to memory of 3964 1892 944e549ba4db11ea3f94a2873ffbe693.exe 75 PID 1892 wrote to memory of 3800 1892 944e549ba4db11ea3f94a2873ffbe693.exe 76 PID 1892 wrote to memory of 3800 1892 944e549ba4db11ea3f94a2873ffbe693.exe 76 PID 1892 wrote to memory of 3800 1892 944e549ba4db11ea3f94a2873ffbe693.exe 76 PID 1892 wrote to memory of 3552 1892 944e549ba4db11ea3f94a2873ffbe693.exe 77 PID 1892 wrote to memory of 3552 1892 944e549ba4db11ea3f94a2873ffbe693.exe 77 PID 1892 wrote to memory of 3552 1892 944e549ba4db11ea3f94a2873ffbe693.exe 77 PID 3552 wrote to memory of 3408 3552 cmd.exe 79 PID 3552 wrote to memory of 3408 3552 cmd.exe 79 PID 3552 wrote to memory of 3408 3552 cmd.exe 79 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 PID 2752 wrote to memory of 3900 2752 p7TeggIuO7.exe 84 - Loads dropped DLL 6 IoCs
pid Process 1892 944e549ba4db11ea3f94a2873ffbe693.exe 1892 944e549ba4db11ea3f94a2873ffbe693.exe 1892 944e549ba4db11ea3f94a2873ffbe693.exe 1892 944e549ba4db11ea3f94a2873ffbe693.exe 1892 944e549ba4db11ea3f94a2873ffbe693.exe 1892 944e549ba4db11ea3f94a2873ffbe693.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3040 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 2224 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 3040 WerFault.exe 2224 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 3040 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 2224 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 2224 WerFault.exe 3040 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe 2208 WerFault.exe - Checks for installed software on the system 1 TTPs 31 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key opened \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key enumerated \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName 944e549ba4db11ea3f94a2873ffbe693.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1516 set thread context of 1892 1516 944e549ba4db11ea3f94a2873ffbe693.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\944e549ba4db11ea3f94a2873ffbe693.exe"C:\Users\Admin\AppData\Local\Temp\944e549ba4db11ea3f94a2873ffbe693.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\944e549ba4db11ea3f94a2873ffbe693.exe"{path}"2⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Checks for installed software on the system
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\p7TeggIuO7.exe"C:\Users\Admin\AppData\Local\Temp\p7TeggIuO7.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\System32\TapiUnattend.exe"4⤵PID:3900
-
-
-
C:\Users\Admin\AppData\Local\Temp\meOcgKwHrM.exe"C:\Users\Admin\AppData\Local\Temp\meOcgKwHrM.exe"3⤵
- Executes dropped EXE
PID:3592 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 11044⤵
- Suspicious use of AdjustPrivilegeToken
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:2208
-
-
-
C:\Users\Admin\AppData\Local\Temp\Px9Bx9qrFZ.exe"C:\Users\Admin\AppData\Local\Temp\Px9Bx9qrFZ.exe"3⤵
- Executes dropped EXE
PID:3964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 10964⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:3040
-
-
-
C:\Users\Admin\AppData\Local\Temp\2bLJ9qxwLq.exe"C:\Users\Admin\AppData\Local\Temp\2bLJ9qxwLq.exe"3⤵
- Executes dropped EXE
PID:3800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 11004⤵
- Suspicious use of AdjustPrivilegeToken
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:2224
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\944e549ba4db11ea3f94a2873ffbe693.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:3408
-
-
-