Analysis Overview
SHA256
bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf
Threat Level: Known bad
The file bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf was found to be: Known bad.
Malicious Activity Summary
MassLogger log file
MassLogger
Checks computer location settings
Reads user/profile data of web browsers
Looks up external IP address via web service
Adds Run key to start application
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
outlook_office_path
outlook_win_path
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-03-27 05:18
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-03-27 05:18
Reported
2022-04-03 14:37
Platform
win7-20220331-en
Max time kernel
111s
Max time network
182s
Command Line
Signatures
MassLogger
MassLogger log file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\"" | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1660 set thread context of 944 | N/A | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe
"C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe"
C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe
"C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 52.20.78.240:80 | api.ipify.org | tcp |
Files
memory/1660-54-0x0000000001270000-0x000000000134C000-memory.dmp
memory/1660-55-0x0000000001150000-0x000000000120C000-memory.dmp
memory/1660-56-0x0000000000680000-0x000000000069C000-memory.dmp
memory/944-57-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/944-58-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/944-60-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/944-61-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/944-62-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/944-63-0x00000000004B31FE-mapping.dmp
memory/944-65-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/944-67-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/944-68-0x00000000006D0000-0x0000000000748000-memory.dmp
memory/944-69-0x00000000010A5000-0x00000000010B6000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-03-27 05:18
Reported
2022-04-03 14:36
Platform
win10v2004-20220331-en
Max time kernel
157s
Max time network
181s
Command Line
Signatures
MassLogger
MassLogger log file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\"" | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4008 set thread context of 4056 | N/A | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe
"C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe"
C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe
"C:\Users\Admin\AppData\Local\Temp\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe"
Network
| Country | Destination | Domain | Proto |
| RU | 23.196.236.146:80 | tcp | |
| IE | 13.69.239.74:443 | tcp | |
| US | 13.107.4.50:80 | tcp | |
| US | 13.107.4.50:80 | tcp | |
| FI | 62.115.252.81:80 | tcp | |
| US | 93.184.220.29:80 | tcp | |
| US | 131.253.33.203:80 | tcp | |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 52.20.78.240:80 | api.ipify.org | tcp |
Files
memory/4008-124-0x0000000000DA0000-0x0000000000E7C000-memory.dmp
memory/4008-125-0x0000000005EA0000-0x0000000006444000-memory.dmp
memory/4008-126-0x0000000005810000-0x00000000058A2000-memory.dmp
memory/4008-127-0x00000000058C0000-0x00000000058CA000-memory.dmp
memory/4008-128-0x0000000005DD0000-0x0000000005E46000-memory.dmp
memory/4008-129-0x0000000005D80000-0x0000000005D9E000-memory.dmp
memory/4056-130-0x0000000000000000-mapping.dmp
memory/4056-131-0x0000000000400000-0x00000000004B8000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bda61889c578ee8c0726b47a62fc71cd5ae277fab761e29898dd8929bcada2bf.exe.log
| MD5 | b5291f3dcf2c13784e09a057f2e43d13 |
| SHA1 | fbb72f4b04269e0d35b1d9c29d02d63dbc7ad07e |
| SHA256 | ad995b51344d71019f96fc3a424de00256065daad8595ff599f6849c87ae75ce |
| SHA512 | 11c89caac425bccaa24e2bb24c6f2b4e6d6863278bf8a5304a42bb44475b08ca586e09143e7d5b14db7f1cd9adacd5358769e0d999dc348073431031067bd4d4 |
memory/4056-133-0x0000000005220000-0x00000000052BC000-memory.dmp
memory/4056-134-0x00000000053C0000-0x0000000005426000-memory.dmp
memory/4056-135-0x0000000005213000-0x0000000005215000-memory.dmp
memory/4056-136-0x00000000073F0000-0x0000000007440000-memory.dmp