Analysis
- max time kernel
137s - max time network
20s - platform
windows7_x64 - resource
win7v200722 - submitted
12/10/2020, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
PO#909612-H232.doc.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO#909612-H232.doc.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target PO#909612-H232.doc.exe
- Size 536KB
- Sample201012-wgz8lsgrls
- SHA256 6f7a133591129c585c8f2e64f359c6b19158e1772c7ce2a8e49b4ebe672a86cb
- MD5 6fb3b1db2d1672cf02f167c8a37a54e3
- SHA1 5a0f14510a2187db4e0b23b5b1bb85c77e3057eb
- SHA512 f9379143ad6e1c1ccd68a16a7b288a13c7a1b8af1e97d0fcf7af51495dcb464195b01d0193f8619d5e3ffdd8cefe56024e2dc1b5ee84d6642dc34e97155a1b60
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" InstallUtil.exe - Executes dropped EXE 2 IoCs
pid Process 888 thunderbird.exe 1016 InstallUtil.exe - Loads dropped DLL 9 IoCs
pid Process 336 PO#909612-H232.doc.exe 336 PO#909612-H232.doc.exe 888 thunderbird.exe 888 thunderbird.exe 888 thunderbird.exe 1016 InstallUtil.exe 1016 InstallUtil.exe 1016 InstallUtil.exe 1016 InstallUtil.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\thunderbird = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\thunderbird.exe" reg.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 888 set thread context of 1016 888 thunderbird.exe 32 - Drops file in Program Files directory 54 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe InstallUtil.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\NOTIFI~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe InstallUtil.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\ELEVAT~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\CHROME~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\CHROME~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\INSTAL~1\setup.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\chrome.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Temp\GUMCD5C.tmp\GOFB2B~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\INSTAL~1\chrmstp.exe InstallUtil.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe InstallUtil.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe InstallUtil.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE InstallUtil.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com InstallUtil.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" InstallUtil.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 336 PO#909612-H232.doc.exe 336 PO#909612-H232.doc.exe 888 thunderbird.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 336 PO#909612-H232.doc.exe Token: SeDebugPrivilege 888 thunderbird.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 336 wrote to memory of 1364 336 PO#909612-H232.doc.exe 28 PID 336 wrote to memory of 1364 336 PO#909612-H232.doc.exe 28 PID 336 wrote to memory of 1364 336 PO#909612-H232.doc.exe 28 PID 336 wrote to memory of 1364 336 PO#909612-H232.doc.exe 28 PID 1364 wrote to memory of 2032 1364 cmd.exe 30 PID 1364 wrote to memory of 2032 1364 cmd.exe 30 PID 1364 wrote to memory of 2032 1364 cmd.exe 30 PID 1364 wrote to memory of 2032 1364 cmd.exe 30 PID 336 wrote to memory of 888 336 PO#909612-H232.doc.exe 31 PID 336 wrote to memory of 888 336 PO#909612-H232.doc.exe 31 PID 336 wrote to memory of 888 336 PO#909612-H232.doc.exe 31 PID 336 wrote to memory of 888 336 PO#909612-H232.doc.exe 31 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32 PID 888 wrote to memory of 1016 888 thunderbird.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#909612-H232.doc.exe"C:\Users\Admin\AppData\Local\Temp\PO#909612-H232.doc.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v thunderbird /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\thunderbird.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v thunderbird /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\thunderbird.exe"3⤵
- Adds Run key to start application
PID:2032
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\thunderbird.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\thunderbird.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1016
-
-