Analysis
-
max time kernel
67s -
max time network
143s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
15-10-2021 07:48
Static task
static1
Behavioral task
behavioral1
Sample
7560b03d9721036181565287e85d9525.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
7560b03d9721036181565287e85d9525.exe
Resource
win10-en-20210920
General
-
Target
7560b03d9721036181565287e85d9525.exe
-
Size
1.1MB
-
MD5
7560b03d9721036181565287e85d9525
-
SHA1
447c0d915c9236b5f3221bfbe05e5b57785d3142
-
SHA256
f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87
-
SHA512
fb38977856b6d4702b1793916c90b0b595dc8881457d6a2a98ba488f80e444314a5e1cdaa0f6a741e6c12b129195fd04f499d84a4cca32386c64fe58ccdfe583
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 744 created 2964 744 WerFault.exe iexplore.exe -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2964-128-0x0000000000411654-mapping.dmp MailPassView -
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2964-128-0x0000000000411654-mapping.dmp Nirsoft -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 944 notepad.exe -
Processes:
7560b03d9721036181565287e85d9525.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 7560b03d9721036181565287e85d9525.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
iexplore.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts iexplore.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe -
Processes:
7560b03d9721036181565287e85d9525.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7560b03d9721036181565287e85d9525.exe -
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1976 2964 WerFault.exe iexplore.exe 744 2964 WerFault.exe iexplore.exe 1476 740 WerFault.exe iexplore.exe 1580 1088 WerFault.exe iexplore.exe 1512 1188 WerFault.exe iexplore.exe 1408 3492 WerFault.exe iexplore.exe -
Suspicious use of SetThreadContext 12 IoCs
Processes:
7560b03d9721036181565287e85d9525.exe7560b03d9721036181565287e85d9525.exeiexplore.exedescription pid process target process PID 2132 set thread context of 3404 2132 7560b03d9721036181565287e85d9525.exe 7560b03d9721036181565287e85d9525.exe PID 3404 set thread context of 3652 3404 7560b03d9721036181565287e85d9525.exe iexplore.exe PID 3652 set thread context of 1788 3652 iexplore.exe iexplore.exe PID 3652 set thread context of 2964 3652 iexplore.exe iexplore.exe PID 3652 set thread context of 1144 3652 iexplore.exe iexplore.exe PID 3652 set thread context of 740 3652 iexplore.exe iexplore.exe PID 3652 set thread context of 1768 3652 iexplore.exe iexplore.exe PID 3652 set thread context of 1088 3652 iexplore.exe iexplore.exe PID 3652 set thread context of 1188 3652 iexplore.exe iexplore.exe PID 3652 set thread context of 3492 3652 iexplore.exe iexplore.exe PID 3652 set thread context of 2316 3652 iexplore.exe iexplore.exe PID 3652 set thread context of 2008 3652 iexplore.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
7560b03d9721036181565287e85d9525.exe7560b03d9721036181565287e85d9525.exeiexplore.exeiexplore.exepid process 2132 7560b03d9721036181565287e85d9525.exe 2132 7560b03d9721036181565287e85d9525.exe 2132 7560b03d9721036181565287e85d9525.exe 3404 7560b03d9721036181565287e85d9525.exe 3404 7560b03d9721036181565287e85d9525.exe 1788 iexplore.exe 1788 iexplore.exe 3404 7560b03d9721036181565287e85d9525.exe 3404 7560b03d9721036181565287e85d9525.exe 1768 iexplore.exe 1768 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
7560b03d9721036181565287e85d9525.exeiexplore.exeiexplore.exedescription pid process Token: SeDebugPrivilege 2132 7560b03d9721036181565287e85d9525.exe Token: SeDebugPrivilege 3652 iexplore.exe Token: SeDebugPrivilege 1788 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7560b03d9721036181565287e85d9525.exeiexplore.exepid process 3404 7560b03d9721036181565287e85d9525.exe 3652 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7560b03d9721036181565287e85d9525.exe7560b03d9721036181565287e85d9525.exeiexplore.exedescription pid process target process PID 2132 wrote to memory of 3404 2132 7560b03d9721036181565287e85d9525.exe 7560b03d9721036181565287e85d9525.exe PID 2132 wrote to memory of 3404 2132 7560b03d9721036181565287e85d9525.exe 7560b03d9721036181565287e85d9525.exe PID 2132 wrote to memory of 3404 2132 7560b03d9721036181565287e85d9525.exe 7560b03d9721036181565287e85d9525.exe PID 2132 wrote to memory of 3404 2132 7560b03d9721036181565287e85d9525.exe 7560b03d9721036181565287e85d9525.exe PID 2132 wrote to memory of 3404 2132 7560b03d9721036181565287e85d9525.exe 7560b03d9721036181565287e85d9525.exe PID 2132 wrote to memory of 3404 2132 7560b03d9721036181565287e85d9525.exe 7560b03d9721036181565287e85d9525.exe PID 2132 wrote to memory of 3404 2132 7560b03d9721036181565287e85d9525.exe 7560b03d9721036181565287e85d9525.exe PID 3404 wrote to memory of 3652 3404 7560b03d9721036181565287e85d9525.exe iexplore.exe PID 3404 wrote to memory of 3652 3404 7560b03d9721036181565287e85d9525.exe iexplore.exe PID 3404 wrote to memory of 3652 3404 7560b03d9721036181565287e85d9525.exe iexplore.exe PID 3404 wrote to memory of 3652 3404 7560b03d9721036181565287e85d9525.exe iexplore.exe PID 3404 wrote to memory of 3652 3404 7560b03d9721036181565287e85d9525.exe iexplore.exe PID 3404 wrote to memory of 3652 3404 7560b03d9721036181565287e85d9525.exe iexplore.exe PID 3404 wrote to memory of 3652 3404 7560b03d9721036181565287e85d9525.exe iexplore.exe PID 3404 wrote to memory of 3652 3404 7560b03d9721036181565287e85d9525.exe iexplore.exe PID 3652 wrote to memory of 944 3652 iexplore.exe notepad.exe PID 3652 wrote to memory of 944 3652 iexplore.exe notepad.exe PID 3652 wrote to memory of 944 3652 iexplore.exe notepad.exe PID 3652 wrote to memory of 944 3652 iexplore.exe notepad.exe PID 3652 wrote to memory of 1788 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1788 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1788 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1788 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1788 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1788 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1788 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1788 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 2964 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 2964 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 2964 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 2964 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 2964 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 2964 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 2964 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 2964 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 2964 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1144 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1144 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1144 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1144 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1144 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1144 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1144 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1144 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1144 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 740 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 740 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 740 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 740 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 740 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 740 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 740 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 740 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 740 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1768 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1768 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1768 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1768 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1768 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1768 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1768 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1768 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1768 3652 iexplore.exe iexplore.exe PID 3652 wrote to memory of 1088 3652 iexplore.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
7560b03d9721036181565287e85d9525.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7560b03d9721036181565287e85d9525.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7560b03d9721036181565287e85d9525.exe"C:\Users\Admin\AppData\Local\Temp\7560b03d9721036181565287e85d9525.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7560b03d9721036181565287e85d9525.exeC:\Users\Admin\AppData\Local\Temp\7560b03d9721036181565287e85d9525.exe2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\7560b03d9721036181565287e85d9525.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
- Deletes itself
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu0.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu1.txt"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 245⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 365⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu1.txt"4⤵
- Accesses Microsoft Outlook accounts
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu2.txt"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 925⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu2.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu3.txt"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 925⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu3.txt"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 925⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu3.txt"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 925⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu3.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu4.txt"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu2.txtMD5
f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\reuefkbwu4.txtMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/740-130-0x0000000000442F04-mapping.dmp
-
memory/944-125-0x0000000000000000-mapping.dmp
-
memory/1088-133-0x0000000000413750-mapping.dmp
-
memory/1144-129-0x0000000000411654-mapping.dmp
-
memory/1188-134-0x0000000000413750-mapping.dmp
-
memory/1768-131-0x0000000000442F04-mapping.dmp
-
memory/1788-127-0x0000000000423BC0-mapping.dmp
-
memory/2008-137-0x000000000040C2A8-mapping.dmp
-
memory/2132-115-0x0000000000760000-0x0000000000761000-memory.dmpFilesize
4KB
-
memory/2132-119-0x0000000005060000-0x0000000005090000-memory.dmpFilesize
192KB
-
memory/2132-118-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/2132-117-0x0000000005140000-0x0000000005251000-memory.dmpFilesize
1.1MB
-
memory/2316-136-0x0000000000413750-mapping.dmp
-
memory/2964-128-0x0000000000411654-mapping.dmp
-
memory/3404-121-0x00000000004010B8-mapping.dmp
-
memory/3404-126-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3404-123-0x0000000001500000-0x000000000150A000-memory.dmpFilesize
40KB
-
memory/3404-122-0x0000000001500000-0x0000000001506000-memory.dmpFilesize
24KB
-
memory/3404-120-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3492-135-0x0000000000413750-mapping.dmp
-
memory/3652-124-0x0000000000401364-mapping.dmp