0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464

Analysis

max time kernel
145s
max time network
156s
platform
windows10_x64
resource
win10v20201028
submitted
17/01/2021, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
Size 9.4MB
Sample210117-r8ma2cd4g2
SHA256 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
MD5 813b749967045532f86e6442447bcd8b
SHA1 8d0615e7f7ba672a3fc94c05a9451f9d08797af7
SHA512 47c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877
MD5 SHA1 SHA512

Score

8^/10

discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3780	SppExtComObj.exe
2268	SppExtComObj.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	ipinfo.io
25	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs

pid	Process
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 3496	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	86
PID 3780 set thread context of 2268	3780	SppExtComObj.exe	114

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\SppExtComObj.exe	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\e1ef82546f0b02b7e974f28047f3788b1128cce1	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2272	1400	WerFault.exe	67
2288	3780	WerFault.exe	104

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1756	schtasks.exe
1288	schtasks.exe
2184	schtasks.exe
3676	schtasks.exe
2220	schtasks.exe
2904	schtasks.exe
2612	schtasks.exe

Delays execution with timeout.exe 6 IoCs

evasion

pid	Process
1324	timeout.exe
3720	timeout.exe
2732	timeout.exe
3896	timeout.exe
1760	timeout.exe
4068	timeout.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
3780	SppExtComObj.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2268	SppExtComObj.exe
2268	SppExtComObj.exe
2268	SppExtComObj.exe
2268	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
Token: SeRestorePrivilege	2272	WerFault.exe
Token: SeBackupPrivilege	2272	WerFault.exe
Token: SeDebugPrivilege	2272	WerFault.exe
Token: SeDebugPrivilege	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
Token: SeDebugPrivilege	3780	SppExtComObj.exe
Token: SeDebugPrivilege	2288	WerFault.exe
Token: SeDebugPrivilege	2268	SppExtComObj.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2268	SppExtComObj.exe

Suspicious use of WriteProcessMemory 78 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 3652	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	75
PID 1400 wrote to memory of 3652	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	75
PID 1400 wrote to memory of 3652	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	75
PID 3652 wrote to memory of 4068	3652	cmd.exe	77
PID 3652 wrote to memory of 4068	3652	cmd.exe	77
PID 3652 wrote to memory of 4068	3652	cmd.exe	77
PID 1400 wrote to memory of 2648	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	78
PID 1400 wrote to memory of 2648	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	78
PID 1400 wrote to memory of 2648	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	78
PID 2648 wrote to memory of 1324	2648	cmd.exe	80
PID 2648 wrote to memory of 1324	2648	cmd.exe	80
PID 2648 wrote to memory of 1324	2648	cmd.exe	80
PID 1400 wrote to memory of 3520	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	81
PID 1400 wrote to memory of 3520	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	81
PID 1400 wrote to memory of 3520	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	81
PID 3520 wrote to memory of 3720	3520	cmd.exe	84
PID 3520 wrote to memory of 3720	3520	cmd.exe	84
PID 3520 wrote to memory of 3720	3520	cmd.exe	84
PID 1400 wrote to memory of 3496	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	86
PID 1400 wrote to memory of 3496	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	86
PID 1400 wrote to memory of 3496	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	86
PID 1400 wrote to memory of 3496	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	86
PID 1400 wrote to memory of 3496	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	86
PID 1400 wrote to memory of 3496	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	86
PID 1400 wrote to memory of 3496	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	86
PID 1400 wrote to memory of 3496	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	86
PID 1400 wrote to memory of 3496	1400	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	86
PID 3496 wrote to memory of 2184	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	90
PID 3496 wrote to memory of 2184	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	90
PID 3496 wrote to memory of 2184	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	90
PID 3496 wrote to memory of 3676	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	92
PID 3496 wrote to memory of 3676	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	92
PID 3496 wrote to memory of 3676	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	92
PID 3496 wrote to memory of 2220	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	94
PID 3496 wrote to memory of 2220	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	94
PID 3496 wrote to memory of 2220	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	94
PID 3496 wrote to memory of 2904	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	96
PID 3496 wrote to memory of 2904	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	96
PID 3496 wrote to memory of 2904	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	96
PID 3496 wrote to memory of 2612	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	98
PID 3496 wrote to memory of 2612	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	98
PID 3496 wrote to memory of 2612	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	98
PID 3496 wrote to memory of 1756	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	100
PID 3496 wrote to memory of 1756	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	100
PID 3496 wrote to memory of 1756	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	100
PID 3496 wrote to memory of 1288	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	102
PID 3496 wrote to memory of 1288	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	102
PID 3496 wrote to memory of 1288	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	102
PID 3496 wrote to memory of 3780	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	104
PID 3496 wrote to memory of 3780	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	104
PID 3496 wrote to memory of 3780	3496	SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe	104
PID 3780 wrote to memory of 1892	3780	SppExtComObj.exe	105
PID 3780 wrote to memory of 1892	3780	SppExtComObj.exe	105
PID 3780 wrote to memory of 1892	3780	SppExtComObj.exe	105
PID 1892 wrote to memory of 2732	1892	cmd.exe	107
PID 1892 wrote to memory of 2732	1892	cmd.exe	107
PID 1892 wrote to memory of 2732	1892	cmd.exe	107
PID 3780 wrote to memory of 3136	3780	SppExtComObj.exe	108
PID 3780 wrote to memory of 3136	3780	SppExtComObj.exe	108
PID 3780 wrote to memory of 3136	3780	SppExtComObj.exe	108
PID 3136 wrote to memory of 3896	3136	cmd.exe	110
PID 3136 wrote to memory of 3896	3136	cmd.exe	110
PID 3136 wrote to memory of 3896	3136	cmd.exe	110
PID 3780 wrote to memory of 4092	3780	SppExtComObj.exe	111
PID 3780 wrote to memory of 4092	3780	SppExtComObj.exe	111
PID 3780 wrote to memory of 4092	3780	SppExtComObj.exe	111
PID 4092 wrote to memory of 1760	4092	cmd.exe	113
PID 4092 wrote to memory of 1760	4092	cmd.exe	113
PID 4092 wrote to memory of 1760	4092	cmd.exe	113
PID 3780 wrote to memory of 2268	3780	SppExtComObj.exe	114
PID 3780 wrote to memory of 2268	3780	SppExtComObj.exe	114
PID 3780 wrote to memory of 2268	3780	SppExtComObj.exe	114
PID 3780 wrote to memory of 2268	3780	SppExtComObj.exe	114
PID 3780 wrote to memory of 2268	3780	SppExtComObj.exe	114
PID 3780 wrote to memory of 2268	3780	SppExtComObj.exe	114
PID 3780 wrote to memory of 2268	3780	SppExtComObj.exe	114
PID 3780 wrote to memory of 2268	3780	SppExtComObj.exe	114
PID 3780 wrote to memory of 2268	3780	SppExtComObj.exe	114

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4068
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3720
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "sihost" /sc ONLOGON /tr "'C:\Documents and Settings\sihost.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2184
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "WerFault" /sc ONLOGON /tr "'C:\Users\Default User\WerFault.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3676
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "WerFault" /sc ONLOGON /tr "'C:\PerfLogs\WerFault.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2220
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "SecuriteInfo.com.Trojan.PackedNET.500.8394.27304" /sc ONLOGON /tr "'C:\PerfLogs\SecuriteInfo.com.Trojan.PackedNET.500.8394.27304.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2904
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Boot\zh-TW\OfficeClickToRun.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2612
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\ShellExperienceHost.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1756
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\SppExtComObj.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1288
- - C:\Program Files (x86)\Windows Photo Viewer\en-US\SppExtComObj.exe
    "C:\Program Files (x86)\Windows Photo Viewer\en-US\SppExtComObj.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2732
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3136
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3896
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      PID:4092
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1760
  - - C:\Program Files (x86)\Windows Photo Viewer\en-US\SppExtComObj.exe
      "C:\Program Files (x86)\Windows Photo Viewer\en-US\SppExtComObj.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1500
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1520
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-7-0x0000000007C00000-0x0000000007D42000-memory.dmp

Download

memory/1400-6-0x0000000007DF0000-0x0000000007DF1000-memory.dmp

Download

memory/1400-12-0x0000000008D40000-0x0000000008D41000-memory.dmp

Download

memory/1400-5-0x0000000005A60000-0x0000000005A61000-memory.dmp

Download

memory/1400-3-0x0000000000920000-0x0000000000921000-memory.dmp

Download

memory/1400-2-0x0000000073FB0000-0x000000007469E000-memory.dmp

Download

memory/2268-69-0x0000000007840000-0x0000000007841000-memory.dmp

Download

memory/2268-57-0x0000000073FB0000-0x000000007469E000-memory.dmp

Download

memory/2268-65-0x0000000006250000-0x0000000006251000-memory.dmp

Download

memory/2268-68-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Download

memory/2268-70-0x0000000006253000-0x0000000006255000-memory.dmp

Download

memory/2272-25-0x0000000004700000-0x0000000004701000-memory.dmp

Download

memory/2272-22-0x0000000004700000-0x0000000004701000-memory.dmp

Download

memory/2288-60-0x0000000004700000-0x0000000004701000-memory.dmp

Download

memory/3496-21-0x0000000005880000-0x0000000005881000-memory.dmp

Download

memory/3496-29-0x00000000064B0000-0x00000000064B1000-memory.dmp

Download

memory/3496-15-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/3496-17-0x0000000073FB0000-0x000000007469E000-memory.dmp

Download

memory/3496-27-0x0000000005900000-0x0000000005901000-memory.dmp

Download

memory/3780-46-0x000000000AB80000-0x000000000AB81000-memory.dmp

Download

memory/3780-41-0x0000000073FB0000-0x000000007469E000-memory.dmp

Download