General

  • Target

    pwininilogs.exe

  • Size

    906KB

  • Sample

    200709-baw665xknj

  • MD5

    a6d1fc86bf6a7b4b7eb6a01ed59e8447

  • SHA1

    d890abdf1a97d66dfcf4d1567d44c29136bc4d7a

  • SHA256

    54121c9dd36d52b71a8fae8703d496f747f65c21c19446087328747ebfe576a5

  • SHA512

    b6fd5f306a4a2fdfb9d4a58461b17a819e2d5bfbde6c57645e2a368740d327f65daed977d1f555a7ed00142b100ea44e523d5761dc1097c408b72899578136dc

Score
7/10

Malware Config

Targets

    • Target

      pwininilogs.exe

    • Size

      906KB

    • MD5

      a6d1fc86bf6a7b4b7eb6a01ed59e8447

    • SHA1

      d890abdf1a97d66dfcf4d1567d44c29136bc4d7a

    • SHA256

      54121c9dd36d52b71a8fae8703d496f747f65c21c19446087328747ebfe576a5

    • SHA512

      b6fd5f306a4a2fdfb9d4a58461b17a819e2d5bfbde6c57645e2a368740d327f65daed977d1f555a7ed00142b100ea44e523d5761dc1097c408b72899578136dc

    Score
    7/10
    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run entry to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks