Analysis
-
max time kernel
87s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:32
Static task
static1
Behavioral task
behavioral1
Sample
air way bill.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
air way bill.exe
Resource
win10v2004-20220414-en
General
-
Target
air way bill.exe
-
Size
861KB
-
MD5
c9e0dc9c74c3782c0319ed1ce090287d
-
SHA1
9fabc323f888b25b7005d2f793ac941c9091f0f3
-
SHA256
b2169a0b14394b89cad7d3d4092b1a3e940c4504f9e7d982ebbcfd0b8c603530
-
SHA512
8d13fa2d64d7a5fcb6e57ec014b18e469092ab122a6850dffbe37afc7d752f5c80a50b4cfa171194cf1e96614c0c9c3de50978c9a26f50805b5a016c436180d5
Malware Config
Extracted
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
air way bill.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation air way bill.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
air way bill.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook air way bill.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook air way bill.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook air way bill.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook air way bill.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook air way bill.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook air way bill.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
air way bill.exedescription pid process target process PID 1612 set thread context of 1484 1612 air way bill.exe air way bill.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
air way bill.exepid process 1484 air way bill.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
air way bill.exeair way bill.exepid process 1612 air way bill.exe 1612 air way bill.exe 1612 air way bill.exe 1612 air way bill.exe 1612 air way bill.exe 1484 air way bill.exe 1484 air way bill.exe 1484 air way bill.exe 1484 air way bill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
air way bill.exeair way bill.exedescription pid process Token: SeDebugPrivilege 1612 air way bill.exe Token: SeDebugPrivilege 1484 air way bill.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
air way bill.exepid process 1484 air way bill.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
air way bill.exedescription pid process target process PID 1612 wrote to memory of 1584 1612 air way bill.exe schtasks.exe PID 1612 wrote to memory of 1584 1612 air way bill.exe schtasks.exe PID 1612 wrote to memory of 1584 1612 air way bill.exe schtasks.exe PID 1612 wrote to memory of 1584 1612 air way bill.exe schtasks.exe PID 1612 wrote to memory of 2000 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 2000 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 2000 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 2000 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1084 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1084 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1084 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1084 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1808 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1808 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1808 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1808 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1484 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1484 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1484 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1484 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1484 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1484 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1484 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1484 1612 air way bill.exe air way bill.exe PID 1612 wrote to memory of 1484 1612 air way bill.exe air way bill.exe -
outlook_office_path 1 IoCs
Processes:
air way bill.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe -
outlook_win_path 1 IoCs
Processes:
air way bill.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 air way bill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\air way bill.exe"C:\Users\Admin\AppData\Local\Temp\air way bill.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eJcljmyFlZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC591.tmp"2⤵
- Creates scheduled task(s)
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\air way bill.exe"{path}"2⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\air way bill.exe"{path}"2⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\air way bill.exe"{path}"2⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\air way bill.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1484
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f1a3a661ce7a812fa9581319488d4822
SHA17695002acfc263b338798e663b858614b87c033b
SHA25642eb314af9caf8897b45219cd1b7d78fb2033e16df0679049709055c85604ea2
SHA512f69d5980adbc553d0191cc4ae7938482c23af1f6cb237c8084b82ff3c95b6358d3475845ab2e298af73850848462d1d20bfe0b0891840ea2b05104d593e84be8