Analysis
-
max time kernel
4294204s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
10/03/2022, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe
Resource
win10v2004-en-20220113
General
-
Target
74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe
-
Size
503KB
-
MD5
9269d21929cfecc5aec59c9ed836e91d
-
SHA1
bb1faaa3de1d17f1e34f69bf30fef5fabbc29bf0
-
SHA256
74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf
-
SHA512
dd53a6799ade998308581b1d145b9fa36c3e2a45d9b150e3a95d13dfb492e30c551bf515c22f67cbd19d0c5e75fdb375e0b4f026087f421e65b2cae8ca42fe48
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
tobias420
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/600-59-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/600-62-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/2000-64-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/2000-67-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 4 IoCs
resource yara_rule behavioral1/memory/600-59-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/600-62-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2000-64-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/2000-67-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 whatismyipaddress.com 7 whatismyipaddress.com 4 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2016 set thread context of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 set thread context of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD772571-A007-11EC-85A2-722BEAC141C4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab8535dea0c55241b6e6a02dc814678c0000000002000000000010660000000100002000000096bf2c2650cc5a0df9fe6f63a30314deebde6c9b3e69c779e051a1201bb47359000000000e8000000002000020000000ea821d3b0b71fd968b8fce186b4da7fc69cceeb619925fc3b335afcbd99de9839000000050b3969e89fdeaa050beb8cb066b946083286e69546fd6ae38a8ec3eb035f21cc5e99214857f7fbe00e0af229eb72c003421c3190ac710da9d107df1070ebcc34e322e36780d7e8f6f18b8211bdc7f07507374f6776d2dc7f9ed8a8d8103c6409c3ebb8af41681563579637211fd4be9c47afe174e5d7749d4854b9f6c47c172fcb4ff80c3b4ddb4f124370debe71437400000001c0e6843040af0abd9eb30358d84a96cb0d0c6591bc866e9914728b72cc82b90876d3db896b218cc8fc586fb6deda51f01592e3ee034a406f3842a55f861da29 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e051ccd41434d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "353636646" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab8535dea0c55241b6e6a02dc814678c00000000020000000000106600000001000020000000b23dff280ce88c5547ddd649e2cf4f94f6f809d5eda21b9f3b84a559c58a62b5000000000e800000000200002000000034ec688d2d4a3d3e3207f206375bfd81d50bac451df5a722c42bfaf849e7a72c20000000bb7de44173577ef53258a341df89b117d97f02322ef14d6cd035839261575f1e4000000085ff8f2c0e80c09ecf6497c3f890ff16e30ae7175e29e9c19ea9c4ab88a545fcae2e826965f5315271c6dd425d75caba1bee4c15ee0d4650179d2a38c079a7e6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2000 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1164 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 1164 iexplore.exe 1164 iexplore.exe 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1164 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 28 PID 2016 wrote to memory of 1164 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 28 PID 2016 wrote to memory of 1164 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 28 PID 2016 wrote to memory of 1164 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 28 PID 1164 wrote to memory of 1644 1164 iexplore.exe 30 PID 1164 wrote to memory of 1644 1164 iexplore.exe 30 PID 1164 wrote to memory of 1644 1164 iexplore.exe 30 PID 1164 wrote to memory of 1644 1164 iexplore.exe 30 PID 2016 wrote to memory of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 wrote to memory of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 wrote to memory of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 wrote to memory of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 wrote to memory of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 wrote to memory of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 wrote to memory of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 wrote to memory of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 wrote to memory of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 wrote to memory of 600 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 31 PID 2016 wrote to memory of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33 PID 2016 wrote to memory of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33 PID 2016 wrote to memory of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33 PID 2016 wrote to memory of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33 PID 2016 wrote to memory of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33 PID 2016 wrote to memory of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33 PID 2016 wrote to memory of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33 PID 2016 wrote to memory of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33 PID 2016 wrote to memory of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33 PID 2016 wrote to memory of 2000 2016 74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe"C:\Users\Admin\AppData\Local\Temp\74e89c8544343ab94dba1506711b6bad2d3de43d190f6afaefb6bff220b9efdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.google.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1644
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"2⤵
- Accesses Microsoft Outlook accounts
PID:600
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2000
-