Analysis
- max time kernel
150s - max time network
113s - platform
windows10_x64 - resource
win10v200722 - submitted
12/10/2020, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
PO#909612-H232.doc.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO#909612-H232.doc.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target PO#909612-H232.doc.exe
- Size 536KB
- Sample201012-wgz8lsgrls
- SHA256 6f7a133591129c585c8f2e64f359c6b19158e1772c7ce2a8e49b4ebe672a86cb
- MD5 6fb3b1db2d1672cf02f167c8a37a54e3
- SHA1 5a0f14510a2187db4e0b23b5b1bb85c77e3057eb
- SHA512 f9379143ad6e1c1ccd68a16a7b288a13c7a1b8af1e97d0fcf7af51495dcb464195b01d0193f8619d5e3ffdd8cefe56024e2dc1b5ee84d6642dc34e97155a1b60
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" InstallUtil.exe - Executes dropped EXE 2 IoCs
pid Process 2592 thunderbird.exe 3592 InstallUtil.exe - Loads dropped DLL 3 IoCs
pid Process 412 PO#909612-H232.doc.exe 2592 thunderbird.exe 2592 thunderbird.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\thunderbird = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\thunderbird.exe" reg.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2592 set thread context of 3592 2592 thunderbird.exe 80 - Drops file in Program Files directory 62 IoCs
description ioc Process File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe InstallUtil.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe InstallUtil.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\INSTAL~1\chrmstp.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\NOTIFI~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\chrome.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe InstallUtil.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\ELEVAT~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe InstallUtil.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\INSTAL~1\setup.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\CHROME~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe InstallUtil.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Temp\GUM19FE.tmp\GOFB2B~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\CHROME~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe InstallUtil.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com InstallUtil.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" InstallUtil.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 412 PO#909612-H232.doc.exe 2592 thunderbird.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 412 PO#909612-H232.doc.exe Token: SeDebugPrivilege 2592 thunderbird.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 412 wrote to memory of 3668 412 PO#909612-H232.doc.exe 76 PID 412 wrote to memory of 3668 412 PO#909612-H232.doc.exe 76 PID 412 wrote to memory of 3668 412 PO#909612-H232.doc.exe 76 PID 3668 wrote to memory of 3728 3668 cmd.exe 78 PID 3668 wrote to memory of 3728 3668 cmd.exe 78 PID 3668 wrote to memory of 3728 3668 cmd.exe 78 PID 412 wrote to memory of 2592 412 PO#909612-H232.doc.exe 79 PID 412 wrote to memory of 2592 412 PO#909612-H232.doc.exe 79 PID 412 wrote to memory of 2592 412 PO#909612-H232.doc.exe 79 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80 PID 2592 wrote to memory of 3592 2592 thunderbird.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#909612-H232.doc.exe"C:\Users\Admin\AppData\Local\Temp\PO#909612-H232.doc.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v thunderbird /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\thunderbird.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v thunderbird /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\thunderbird.exe"3⤵
- Adds Run key to start application
PID:3728
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\thunderbird.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\thunderbird.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:3592
-
-