Analysis Overview
SHA256
3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93
Threat Level: Known bad
The file 3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93 was found to be: Known bad.
Malicious Activity Summary
MassLogger
MassLogger log file
Checks computer location settings
Reads user/profile data of web browsers
Adds Run key to start application
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Suspicious use of SetThreadContext
Suspicious behavior: AddClipboardFormatListener
outlook_office_path
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
outlook_win_path
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-04-14 13:36
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2022-04-14 13:36
Reported
2022-04-14 14:57
Platform
win10v2004-20220331-en
Max time kernel
170s
Max time network
184s
Command Line
Signatures
MassLogger
MassLogger log file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\"" | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4948 set thread context of 4328 | N/A | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe
"C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe"
C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe
"C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe"
Network
| Country | Destination | Domain | Proto |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 52.242.97.97:443 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 8.8.8.8:53 | 151.122.125.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 176.122.125.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 54.91.59.199:80 | api.ipify.org | tcp |
Files
memory/4948-124-0x0000000000050000-0x00000000001B8000-memory.dmp
memory/4948-125-0x00000000050B0000-0x0000000005654000-memory.dmp
memory/4948-126-0x0000000004B80000-0x0000000004BF6000-memory.dmp
memory/4948-127-0x0000000004EF0000-0x0000000004F0E000-memory.dmp
memory/4328-128-0x0000000000000000-mapping.dmp
memory/4328-129-0x0000000000400000-0x00000000004B8000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe.log
| MD5 | 73f7cf0cc0d233587dab42e5f96d3055 |
| SHA1 | bd4763dec908b33d502e1ad6528e5b3b6d556849 |
| SHA256 | 42950caa27b247f877d372f7afeb4e1f30843d7668489881d0d3a5fc1fda8a44 |
| SHA512 | d6d7c6812bd9f138570499974e90052e7929fdfe18c5915d5de7ccf926e17290bca03b03102e3396f30d2281e405d5047de50074e5e7bc5dc9d7474590701782 |
memory/4328-131-0x0000000005160000-0x00000000051FC000-memory.dmp
memory/4328-132-0x0000000005270000-0x00000000052D6000-memory.dmp
memory/4328-133-0x0000000005580000-0x0000000005612000-memory.dmp
memory/4328-134-0x00000000068D0000-0x00000000068DA000-memory.dmp
memory/4328-135-0x0000000005153000-0x0000000005155000-memory.dmp
memory/4328-136-0x0000000006AF0000-0x0000000006B40000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2022-04-14 13:36
Reported
2022-04-14 14:56
Platform
win7-20220311-en
Max time kernel
4294181s
Max time network
143s
Command Line
Signatures
MassLogger
MassLogger log file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\"" | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1368 set thread context of 652 | N/A | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe
"C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe"
C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe
"C:\Users\Admin\AppData\Local\Temp\3d44d7bea2dcf261e79424004a4e05c721ce1d8fe4fd7c5b0785d6fbf4a17c93.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 52.20.78.240:80 | api.ipify.org | tcp |
Files
memory/1368-54-0x0000000000F60000-0x00000000010C8000-memory.dmp
memory/1368-55-0x00000000025E0000-0x000000000268A000-memory.dmp
memory/1368-56-0x0000000000440000-0x000000000045C000-memory.dmp
memory/652-57-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/652-58-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/652-60-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/652-61-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/652-62-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/652-63-0x00000000004B31FE-mapping.dmp
memory/652-65-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/652-67-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/652-68-0x0000000000D90000-0x0000000000E08000-memory.dmp
memory/652-69-0x0000000000EE5000-0x0000000000EF6000-memory.dmp