Malware Analysis Report

2024-10-19 08:46

Sample ID 220520-3wxxpaceck
Target be2977307f46f30facce8c214c93fd615777f6b5b7f7157ee504080ea98b0ca2
SHA256 be2977307f46f30facce8c214c93fd615777f6b5b7f7157ee504080ea98b0ca2
Tags
masslogger collection ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

be2977307f46f30facce8c214c93fd615777f6b5b7f7157ee504080ea98b0ca2

Threat Level: Known bad

The file be2977307f46f30facce8c214c93fd615777f6b5b7f7157ee504080ea98b0ca2 was found to be: Known bad.

Malicious Activity Summary

masslogger collection ransomware spyware stealer

MassLogger

MassLogger log file

Checks computer location settings

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

outlook_win_path

Suspicious behavior: AddClipboardFormatListener

Creates scheduled task(s)

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-20 23:52

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-20 23:52

Reported

2022-05-21 06:05

Platform

win7-20220414-en

Max time kernel

120s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe"

Signatures

MassLogger

stealer spyware masslogger

MassLogger log file

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1260 set thread context of 332 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1260 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Windows\SysWOW64\schtasks.exe
PID 1260 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Windows\SysWOW64\schtasks.exe
PID 1260 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Windows\SysWOW64\schtasks.exe
PID 1260 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Windows\SysWOW64\schtasks.exe
PID 1260 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 1260 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 1260 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 1260 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 1260 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 1260 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 1260 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 1260 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 1260 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe

outlook_office_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

outlook_win_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe

"C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD2DA.tmp"

C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe

"{path}"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 3.232.242.170:80 api.ipify.org tcp
US 8.8.8.8:53 mail.privateemail.com udp
US 198.54.122.135:587 mail.privateemail.com tcp

Files

memory/1260-54-0x0000000000940000-0x0000000000AE0000-memory.dmp

memory/1260-55-0x0000000000440000-0x0000000000448000-memory.dmp

memory/1260-56-0x00000000005F0000-0x00000000006C4000-memory.dmp

memory/1260-57-0x0000000007930000-0x00000000079FC000-memory.dmp

memory/1040-58-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD2DA.tmp

MD5 d9b3fb55144055bf53049ae44e24a2b4
SHA1 e01d7cbee7c35cac28b467f84e92b7a48d32d61e
SHA256 7b950a718804352c3350d97782b2db4cd0e4fa78d1fded8b7f56edfa9df4a437
SHA512 001c56ee85bf76eb22969026c4ddd0f784052c37144642d8124b4fe0db1893bba55b2f5c4739a5a8cb54cdab5b1ea37ad830b34c429fdac0b8f93a4d5acc052c

memory/332-60-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/332-61-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/332-63-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/332-64-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/332-65-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/332-66-0x00000000004BBDEE-mapping.dmp

memory/332-68-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/332-70-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/332-71-0x0000000004380000-0x00000000043F8000-memory.dmp

memory/332-72-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

memory/332-73-0x0000000004E35000-0x0000000004E46000-memory.dmp

memory/332-74-0x0000000000B80000-0x0000000000B94000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-20 23:52

Reported

2022-05-21 06:04

Platform

win10v2004-20220414-en

Max time kernel

108s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe"

Signatures

MassLogger

stealer spyware masslogger

MassLogger log file

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2184 set thread context of 2772 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Windows\SysWOW64\schtasks.exe
PID 2184 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Windows\SysWOW64\schtasks.exe
PID 2184 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Windows\SysWOW64\schtasks.exe
PID 2184 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe
PID 2184 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe

outlook_office_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

outlook_win_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe

"C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1131.tmp"

C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\URGENT ORDER SO 22-2020 WSO-20-03121.exe

"{path}"

Network

Country Destination Domain Proto
US 52.109.8.21:443 tcp
US 20.189.173.10:443 tcp
DE 67.24.27.254:80 tcp
BE 8.238.110.126:80 tcp
BE 8.238.110.126:80 tcp
BE 8.238.110.126:80 tcp
US 8.8.8.8:53 api.ipify.org udp
US 3.220.57.224:80 api.ipify.org tcp
US 8.8.8.8:53 mail.privateemail.com udp
US 198.54.122.135:587 mail.privateemail.com tcp

Files

memory/2184-130-0x0000000000540000-0x00000000006E0000-memory.dmp

memory/2184-131-0x00000000078F0000-0x000000000798C000-memory.dmp

memory/2184-132-0x0000000007A30000-0x0000000007AC2000-memory.dmp

memory/348-133-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1131.tmp

MD5 ab9f8a9574d9209cd8666decb37e33cc
SHA1 b768b98d37b96bcf5eeeb4bae10589a196b66db2
SHA256 2c052172f943620c36053efd2ab1d6ef9fbb671c55669b9f49430f0f7acd7704
SHA512 5059538580cce17a2c7516e3117297310455e38ff32d51c6e17ef188448ce3567f9c968ad478df725ed2ce8630ceee2340246264a6e60877895591a67d45da70

memory/3864-135-0x0000000000000000-mapping.dmp

memory/3628-136-0x0000000000000000-mapping.dmp

memory/2772-137-0x0000000000000000-mapping.dmp

memory/2772-138-0x0000000000400000-0x00000000004C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\URGENT ORDER SO 22-2020 WSO-20-03121.exe.log

MD5 bceb1b24038a079a8046db250ce33039
SHA1 95d2a21b00e5c127f023d2950afe052d2acba572
SHA256 d5237a1aac346aaff3cedaca0a567afa529b84a21676e4c7017c9f87cfb32d57
SHA512 182dc30cd1e600da9b7ea1ca12860fd82237b04de293899d19ab7edb8b2bcdb37e30d387bbdbb54acdbecdb8200f5a39d417abd91d2b4c11fd126a9e4d0f050e

memory/2772-140-0x0000000005810000-0x0000000005DB4000-memory.dmp

memory/2772-141-0x0000000005350000-0x00000000053B6000-memory.dmp

memory/2772-142-0x0000000007200000-0x000000000720A000-memory.dmp

memory/2772-143-0x00000000072C0000-0x0000000007310000-memory.dmp