7zS850A099E.zip
General
Target
Filesize
Completed
7zS850A099E/61e74fd53f766_Tue23ec97445e.exe
160KB
19-01-2022 08:14
Score
10/10
MD5
SHA1
SHA256
8f70a0f45532261cb4df2800b141551d
521bbc045dfb7bf9fca55058ed2fc03d86cf8d00
aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5
Malware Config
Signatures 14
Filter: none
Collection
Credential Access
Defense Evasion
Discovery
Persistence
-
Modifies Windows Defender Real-time Protection settings
Tags
TTPs
-
Downloads MZ/PE file
-
Executes dropped EXEpQ1dYR6DeSA6o_PH6sod_VLO.exe
Reported IOCs
pid process 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe -
Checks computer location settings61e74fd53f766_Tue23ec97445e.exe
Description
Looks up country code configured in the registry, likely geofence.
TTPs
Reported IOCs
description ioc process Key value queried \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\International\Geo\Nation 61e74fd53f766_Tue23ec97445e.exe -
Loads dropped DLL61e74fd53f766_Tue23ec97445e.exe
Reported IOCs
pid process 1688 61e74fd53f766_Tue23ec97445e.exe -
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Legitimate hosting services abused for malware hosting/C2
TTPs
-
Looks up external IP address via web service
Description
Uses a legitimate IP lookup service to find the infected system's external IP.
Reported IOCs
flow ioc 19 ipinfo.io 20 ipinfo.io -
Enumerates physical storage devices
Description
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
TTPs
-
Program crashWerFault.exe
Reported IOCs
pid pid_target process target process 1716 1688 WerFault.exe 61e74fd53f766_Tue23ec97445e.exe -
Suspicious behavior: EnumeratesProcessespQ1dYR6DeSA6o_PH6sod_VLO.exe
Reported IOCs
pid process 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe 1320 pQ1dYR6DeSA6o_PH6sod_VLO.exe -
Suspicious behavior: GetForegroundWindowSpamWerFault.exe
Reported IOCs
pid process 1716 WerFault.exe -
Suspicious use of AdjustPrivilegeTokenWerFault.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 1716 WerFault.exe -
Suspicious use of WriteProcessMemory61e74fd53f766_Tue23ec97445e.exe
Reported IOCs
description pid process target process PID 1688 wrote to memory of 1320 1688 61e74fd53f766_Tue23ec97445e.exe pQ1dYR6DeSA6o_PH6sod_VLO.exe PID 1688 wrote to memory of 1320 1688 61e74fd53f766_Tue23ec97445e.exe pQ1dYR6DeSA6o_PH6sod_VLO.exe PID 1688 wrote to memory of 1320 1688 61e74fd53f766_Tue23ec97445e.exe pQ1dYR6DeSA6o_PH6sod_VLO.exe PID 1688 wrote to memory of 1320 1688 61e74fd53f766_Tue23ec97445e.exe pQ1dYR6DeSA6o_PH6sod_VLO.exe PID 1688 wrote to memory of 1716 1688 61e74fd53f766_Tue23ec97445e.exe WerFault.exe PID 1688 wrote to memory of 1716 1688 61e74fd53f766_Tue23ec97445e.exe WerFault.exe PID 1688 wrote to memory of 1716 1688 61e74fd53f766_Tue23ec97445e.exe WerFault.exe PID 1688 wrote to memory of 1716 1688 61e74fd53f766_Tue23ec97445e.exe WerFault.exe
Processes 3
-
C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e74fd53f766_Tue23ec97445e.exePID:1688"C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e74fd53f766_Tue23ec97445e.exe"Checks computer location settingsLoads dropped DLLSuspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\pQ1dYR6DeSA6o_PH6sod_VLO.exePID:1320"C:\Users\Admin\Pictures\Adobe Films\pQ1dYR6DeSA6o_PH6sod_VLO.exe"Executes dropped EXESuspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exePID:1716C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 1424Program crashSuspicious behavior: GetForegroundWindowSpamSuspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
C:\Users\Admin\Pictures\Adobe Films\pQ1dYR6DeSA6o_PH6sod_VLO.exe
MD53f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
\Users\Admin\Pictures\Adobe Films\pQ1dYR6DeSA6o_PH6sod_VLO.exe
MD53f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
memory/1688-54-0x0000000076151000-0x0000000076153000-memory.dmp
-
memory/1716-60-0x0000000000730000-0x0000000000731000-memory.dmp
Title
Loading data