Analysis Overview
SHA256
b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed
Threat Level: Known bad
The file b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed was found to be: Known bad.
Malicious Activity Summary
MassLogger Main Payload
MassLogger
Reads user/profile data of web browsers
Checks computer location settings
Looks up external IP address via web service
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Suspicious behavior: EnumeratesProcesses
outlook_office_path
outlook_win_path
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-04-15 12:35
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-04-15 12:35
Reported
2022-04-15 12:40
Platform
win7-20220414-en
Max time kernel
100s
Max time network
153s
Command Line
Signatures
MassLogger
MassLogger Main Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1860 set thread context of 948 | N/A | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe
"C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe"
C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe
"C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 52.20.78.240:80 | api.ipify.org | tcp |
Files
memory/1860-54-0x0000000000C70000-0x0000000000DE6000-memory.dmp
memory/1860-55-0x00000000084A0000-0x000000000857C000-memory.dmp
memory/1860-56-0x00000000001E0000-0x00000000001FC000-memory.dmp
memory/1860-57-0x00000000061C0000-0x000000000627E000-memory.dmp
memory/1860-58-0x0000000000410000-0x000000000041A000-memory.dmp
memory/1860-59-0x0000000006280000-0x0000000006308000-memory.dmp
memory/948-60-0x0000000000400000-0x0000000000486000-memory.dmp
memory/948-61-0x0000000000400000-0x0000000000486000-memory.dmp
memory/948-63-0x0000000000400000-0x0000000000486000-memory.dmp
memory/948-64-0x0000000000400000-0x0000000000486000-memory.dmp
memory/948-65-0x0000000000400000-0x0000000000486000-memory.dmp
memory/948-66-0x00000000004817EE-mapping.dmp
memory/948-68-0x0000000000400000-0x0000000000486000-memory.dmp
memory/948-70-0x0000000000400000-0x0000000000486000-memory.dmp
memory/948-71-0x0000000000735000-0x0000000000746000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-04-15 12:35
Reported
2022-04-15 12:40
Platform
win10v2004-20220414-en
Max time kernel
105s
Max time network
101s
Command Line
Signatures
MassLogger
MassLogger Main Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4984 set thread context of 4204 | N/A | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe
"C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe"
C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe
"C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe"
C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe
"C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe"
C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe
"C:\Users\Admin\AppData\Local\Temp\b55cc68932bd36e0d0da05c5c40afd2416e6a505822584667780b48e469f22ed.exe"
Network
| Country | Destination | Domain | Proto |
| US | 20.189.173.2:443 | tcp | |
| NL | 104.110.191.133:80 | tcp | |
| NL | 104.110.191.133:80 | tcp | |
| NL | 104.110.191.133:80 | tcp | |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 52.20.78.240:80 | api.ipify.org | tcp |
Files
memory/4984-130-0x0000000000BA0000-0x0000000000D16000-memory.dmp
memory/4984-131-0x000000000B010000-0x000000000B0AC000-memory.dmp
memory/4984-132-0x000000000B660000-0x000000000BC04000-memory.dmp
memory/4984-133-0x000000000B0B0000-0x000000000B142000-memory.dmp
memory/4984-134-0x00000000058D0000-0x00000000058DA000-memory.dmp
memory/4984-135-0x000000000B240000-0x000000000B296000-memory.dmp
memory/4552-136-0x0000000000000000-mapping.dmp
memory/2832-137-0x0000000000000000-mapping.dmp
memory/4204-138-0x0000000000000000-mapping.dmp
memory/4204-139-0x0000000000400000-0x0000000000486000-memory.dmp
memory/4204-140-0x0000000006390000-0x00000000063F6000-memory.dmp
memory/4204-141-0x0000000006D10000-0x0000000006D60000-memory.dmp
memory/4204-142-0x00000000051A3000-0x00000000051A5000-memory.dmp