Analysis
-
max time kernel
79s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:18
Static task
static1
Behavioral task
behavioral1
Sample
Peace Transit Order 1670.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Peace Transit Order 1670.exe
Resource
win10v2004-20220414-en
General
-
Target
Peace Transit Order 1670.exe
-
Size
920KB
-
MD5
8aa67c5024bfee5226d38305f3736291
-
SHA1
56eba5c41aa2a88480834f37393e397d3e6260c8
-
SHA256
c9787a5aeefa1606bd166b54177d9f685dd01f03632ff9f3952909193c657028
-
SHA512
692adfe96ca0779a79fb9207e0a5e62dbd85887a53ccb8537bb600f9a2937fe2b7bf41643646fdf04f404922d96eaa72042a9a44fd78141ecd1cf3d9d868ba52
Malware Config
Extracted
C:\Users\Admin\AppData\Local\79FE0CC911\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Peace Transit Order 1670.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation Peace Transit Order 1670.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
Peace Transit Order 1670.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook Peace Transit Order 1670.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Peace Transit Order 1670.exedescription pid process target process PID 1928 set thread context of 580 1928 Peace Transit Order 1670.exe Peace Transit Order 1670.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Peace Transit Order 1670.exePeace Transit Order 1670.exepid process 1928 Peace Transit Order 1670.exe 1928 Peace Transit Order 1670.exe 1928 Peace Transit Order 1670.exe 1928 Peace Transit Order 1670.exe 1928 Peace Transit Order 1670.exe 580 Peace Transit Order 1670.exe 580 Peace Transit Order 1670.exe 580 Peace Transit Order 1670.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Peace Transit Order 1670.exePeace Transit Order 1670.exedescription pid process Token: SeDebugPrivilege 1928 Peace Transit Order 1670.exe Token: SeDebugPrivilege 580 Peace Transit Order 1670.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Peace Transit Order 1670.exedescription pid process target process PID 1928 wrote to memory of 992 1928 Peace Transit Order 1670.exe schtasks.exe PID 1928 wrote to memory of 992 1928 Peace Transit Order 1670.exe schtasks.exe PID 1928 wrote to memory of 992 1928 Peace Transit Order 1670.exe schtasks.exe PID 1928 wrote to memory of 992 1928 Peace Transit Order 1670.exe schtasks.exe PID 1928 wrote to memory of 580 1928 Peace Transit Order 1670.exe Peace Transit Order 1670.exe PID 1928 wrote to memory of 580 1928 Peace Transit Order 1670.exe Peace Transit Order 1670.exe PID 1928 wrote to memory of 580 1928 Peace Transit Order 1670.exe Peace Transit Order 1670.exe PID 1928 wrote to memory of 580 1928 Peace Transit Order 1670.exe Peace Transit Order 1670.exe PID 1928 wrote to memory of 580 1928 Peace Transit Order 1670.exe Peace Transit Order 1670.exe PID 1928 wrote to memory of 580 1928 Peace Transit Order 1670.exe Peace Transit Order 1670.exe PID 1928 wrote to memory of 580 1928 Peace Transit Order 1670.exe Peace Transit Order 1670.exe PID 1928 wrote to memory of 580 1928 Peace Transit Order 1670.exe Peace Transit Order 1670.exe PID 1928 wrote to memory of 580 1928 Peace Transit Order 1670.exe Peace Transit Order 1670.exe -
outlook_office_path 1 IoCs
Processes:
Peace Transit Order 1670.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe -
outlook_win_path 1 IoCs
Processes:
Peace Transit Order 1670.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Peace Transit Order 1670.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Peace Transit Order 1670.exe"C:\Users\Admin\AppData\Local\Temp\Peace Transit Order 1670.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ycNQvjaCvnS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEABD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Peace Transit Order 1670.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEABD.tmpFilesize
1KB
MD56ecc73262c966473448bd03f413caca0
SHA151319c40745fc3815f78cae9ae6e0f73c7166324
SHA256e69494c7c29686b1f45057367e49307ead467937413a566b6f932b8ff214c0cc
SHA51290f062d3dcdc2a2c231fef4aa44f60f9a3aeb04080984409b2892054cb3def5ac3c807dc2f0d222aa092e101258e2d75ba24c831adf6b866f7cdc16fb15fee9d
-
memory/580-68-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/580-61-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/580-73-0x0000000004DB5000-0x0000000004DC6000-memory.dmpFilesize
68KB
-
memory/580-72-0x0000000076011000-0x0000000076013000-memory.dmpFilesize
8KB
-
memory/580-64-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/580-60-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/580-71-0x0000000000F60000-0x0000000000FD8000-memory.dmpFilesize
480KB
-
memory/580-63-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/580-70-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/580-65-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/580-66-0x00000000004B2DCE-mapping.dmp
-
memory/992-58-0x0000000000000000-mapping.dmp
-
memory/1928-54-0x0000000001210000-0x00000000012FC000-memory.dmpFilesize
944KB
-
memory/1928-55-0x0000000000330000-0x000000000033A000-memory.dmpFilesize
40KB
-
memory/1928-56-0x0000000005850000-0x000000000590E000-memory.dmpFilesize
760KB
-
memory/1928-57-0x0000000005AC0000-0x0000000005B78000-memory.dmpFilesize
736KB