7zS850A099E.zip

General
Target

7zS850A099E/61e74fd53f766_Tue23ec97445e.exe

Filesize

160KB

Completed

19-01-2022 08:14

Score
10/10
MD5

8f70a0f45532261cb4df2800b141551d

SHA1

521bbc045dfb7bf9fca55058ed2fc03d86cf8d00

SHA256

aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5

Malware Config
Signatures 14

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • Downloads MZ/PE file
  • Executes dropped EXE
    pQ1dYR6DeSA6o_PH6sod_VLO.exe

    Reported IOCs

    pidprocess
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
  • Checks computer location settings
    61e74fd53f766_Tue23ec97445e.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\International\Geo\Nation61e74fd53f766_Tue23ec97445e.exe
  • Loads dropped DLL
    61e74fd53f766_Tue23ec97445e.exe

    Reported IOCs

    pidprocess
    168861e74fd53f766_Tue23ec97445e.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    19ipinfo.io
    20ipinfo.io
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    17161688WerFault.exe61e74fd53f766_Tue23ec97445e.exe
  • Suspicious behavior: EnumeratesProcesses
    pQ1dYR6DeSA6o_PH6sod_VLO.exe

    Reported IOCs

    pidprocess
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
    1320pQ1dYR6DeSA6o_PH6sod_VLO.exe
  • Suspicious behavior: GetForegroundWindowSpam
    WerFault.exe

    Reported IOCs

    pidprocess
    1716WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1716WerFault.exe
  • Suspicious use of WriteProcessMemory
    61e74fd53f766_Tue23ec97445e.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1688 wrote to memory of 1320168861e74fd53f766_Tue23ec97445e.exepQ1dYR6DeSA6o_PH6sod_VLO.exe
    PID 1688 wrote to memory of 1320168861e74fd53f766_Tue23ec97445e.exepQ1dYR6DeSA6o_PH6sod_VLO.exe
    PID 1688 wrote to memory of 1320168861e74fd53f766_Tue23ec97445e.exepQ1dYR6DeSA6o_PH6sod_VLO.exe
    PID 1688 wrote to memory of 1320168861e74fd53f766_Tue23ec97445e.exepQ1dYR6DeSA6o_PH6sod_VLO.exe
    PID 1688 wrote to memory of 1716168861e74fd53f766_Tue23ec97445e.exeWerFault.exe
    PID 1688 wrote to memory of 1716168861e74fd53f766_Tue23ec97445e.exeWerFault.exe
    PID 1688 wrote to memory of 1716168861e74fd53f766_Tue23ec97445e.exeWerFault.exe
    PID 1688 wrote to memory of 1716168861e74fd53f766_Tue23ec97445e.exeWerFault.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e74fd53f766_Tue23ec97445e.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e74fd53f766_Tue23ec97445e.exe"
    Checks computer location settings
    Loads dropped DLL
    Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Users\Admin\Pictures\Adobe Films\pQ1dYR6DeSA6o_PH6sod_VLO.exe
      "C:\Users\Admin\Pictures\Adobe Films\pQ1dYR6DeSA6o_PH6sod_VLO.exe"
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1320
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 1424
      Program crash
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1716
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Users\Admin\Pictures\Adobe Films\pQ1dYR6DeSA6o_PH6sod_VLO.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • \Users\Admin\Pictures\Adobe Films\pQ1dYR6DeSA6o_PH6sod_VLO.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • memory/1688-54-0x0000000076151000-0x0000000076153000-memory.dmp

                • memory/1716-60-0x0000000000730000-0x0000000000731000-memory.dmp