Analysis Overview
SHA256
be2977307f46f30facce8c214c93fd615777f6b5b7f7157ee504080ea98b0ca2
Threat Level: Known bad
The file be2977307f46f30facce8c214c93fd615777f6b5b7f7157ee504080ea98b0ca2 was found to be: Known bad.
Malicious Activity Summary
MassLogger
MassLogger log file
Checks computer location settings
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Suspicious use of SetThreadContext
Enumerates physical storage devices
outlook_win_path
Suspicious behavior: AddClipboardFormatListener
Creates scheduled task(s)
outlook_office_path
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-05-20 23:52
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-20 23:52
Reported
2022-05-21 06:05
Platform
win7-20220414-en
Max time kernel
120s
Max time network
125s
Command Line
Signatures
MassLogger
MassLogger log file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1260 set thread context of 332 | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
"C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD2DA.tmp"
C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
"{path}"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 3.232.242.170:80 | api.ipify.org | tcp |
| US | 8.8.8.8:53 | mail.privateemail.com | udp |
| US | 198.54.122.135:587 | mail.privateemail.com | tcp |
Files
memory/1260-54-0x0000000000940000-0x0000000000AE0000-memory.dmp
memory/1260-55-0x0000000000440000-0x0000000000448000-memory.dmp
memory/1260-56-0x00000000005F0000-0x00000000006C4000-memory.dmp
memory/1260-57-0x0000000007930000-0x00000000079FC000-memory.dmp
memory/1040-58-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\tmpD2DA.tmp
| MD5 | d9b3fb55144055bf53049ae44e24a2b4 |
| SHA1 | e01d7cbee7c35cac28b467f84e92b7a48d32d61e |
| SHA256 | 7b950a718804352c3350d97782b2db4cd0e4fa78d1fded8b7f56edfa9df4a437 |
| SHA512 | 001c56ee85bf76eb22969026c4ddd0f784052c37144642d8124b4fe0db1893bba55b2f5c4739a5a8cb54cdab5b1ea37ad830b34c429fdac0b8f93a4d5acc052c |
memory/332-60-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/332-61-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/332-63-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/332-64-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/332-65-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/332-66-0x00000000004BBDEE-mapping.dmp
memory/332-68-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/332-70-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/332-71-0x0000000004380000-0x00000000043F8000-memory.dmp
memory/332-72-0x0000000075CE1000-0x0000000075CE3000-memory.dmp
memory/332-73-0x0000000004E35000-0x0000000004E46000-memory.dmp
memory/332-74-0x0000000000B80000-0x0000000000B94000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-20 23:52
Reported
2022-05-21 06:04
Platform
win10v2004-20220414-en
Max time kernel
108s
Max time network
139s
Command Line
Signatures
MassLogger
MassLogger log file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2184 set thread context of 2772 | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
"C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1131.tmp"
C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
"{path}"
C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
"{path}"
C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
"{path}"
Network
| Country | Destination | Domain | Proto |
| US | 52.109.8.21:443 | tcp | |
| US | 20.189.173.10:443 | tcp | |
| DE | 67.24.27.254:80 | tcp | |
| BE | 8.238.110.126:80 | tcp | |
| BE | 8.238.110.126:80 | tcp | |
| BE | 8.238.110.126:80 | tcp | |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 3.220.57.224:80 | api.ipify.org | tcp |
| US | 8.8.8.8:53 | mail.privateemail.com | udp |
| US | 198.54.122.135:587 | mail.privateemail.com | tcp |
Files
memory/2184-130-0x0000000000540000-0x00000000006E0000-memory.dmp
memory/2184-131-0x00000000078F0000-0x000000000798C000-memory.dmp
memory/2184-132-0x0000000007A30000-0x0000000007AC2000-memory.dmp
memory/348-133-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\tmp1131.tmp
| MD5 | ab9f8a9574d9209cd8666decb37e33cc |
| SHA1 | b768b98d37b96bcf5eeeb4bae10589a196b66db2 |
| SHA256 | 2c052172f943620c36053efd2ab1d6ef9fbb671c55669b9f49430f0f7acd7704 |
| SHA512 | 5059538580cce17a2c7516e3117297310455e38ff32d51c6e17ef188448ce3567f9c968ad478df725ed2ce8630ceee2340246264a6e60877895591a67d45da70 |
memory/3864-135-0x0000000000000000-mapping.dmp
memory/3628-136-0x0000000000000000-mapping.dmp
memory/2772-137-0x0000000000000000-mapping.dmp
memory/2772-138-0x0000000000400000-0x00000000004C0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\URGENT ORDER SO 22-2020 WSO-20-03121.exe.log
| MD5 | bceb1b24038a079a8046db250ce33039 |
| SHA1 | 95d2a21b00e5c127f023d2950afe052d2acba572 |
| SHA256 | d5237a1aac346aaff3cedaca0a567afa529b84a21676e4c7017c9f87cfb32d57 |
| SHA512 | 182dc30cd1e600da9b7ea1ca12860fd82237b04de293899d19ab7edb8b2bcdb37e30d387bbdbb54acdbecdb8200f5a39d417abd91d2b4c11fd126a9e4d0f050e |
memory/2772-140-0x0000000005810000-0x0000000005DB4000-memory.dmp
memory/2772-141-0x0000000005350000-0x00000000053B6000-memory.dmp
memory/2772-142-0x0000000007200000-0x000000000720A000-memory.dmp
memory/2772-143-0x00000000072C0000-0x0000000007310000-memory.dmp