Analysis
-
max time kernel
147s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:34
Static task
static1
Behavioral task
behavioral1
Sample
MV Crystal BAY_pdf..exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
MV Crystal BAY_pdf..exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
MV Crystal BAY_pdf..exe
-
Size
588KB
-
MD5
0d9e0a5ee2370181e6df2d49bf3245b0
-
SHA1
1c5a84f18225c10123f2f96879976eacda666c65
-
SHA256
58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d
-
SHA512
9276f6794455ec0c3143af07d9bb299261c875ce3f342ade786ded83bd4f2835972089429870835398b46a0aa5ca6b3cf244df47e52f3397e8a2e1f649db8f3a
Score
10/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MV Crystal BAY_pdf..exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MV Crystal BAY_pdf..exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook MV Crystal BAY_pdf..exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MV Crystal BAY_pdf..exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
MV Crystal BAY_pdf..exedescription pid process target process PID 1496 set thread context of 912 1496 MV Crystal BAY_pdf..exe MV Crystal BAY_pdf..exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
MV Crystal BAY_pdf..exepid process 1496 MV Crystal BAY_pdf..exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
MV Crystal BAY_pdf..exepid process 1496 MV Crystal BAY_pdf..exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
MV Crystal BAY_pdf..exepid process 912 MV Crystal BAY_pdf..exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MV Crystal BAY_pdf..exedescription pid process Token: SeDebugPrivilege 912 MV Crystal BAY_pdf..exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
MV Crystal BAY_pdf..exedescription pid process target process PID 1496 wrote to memory of 912 1496 MV Crystal BAY_pdf..exe MV Crystal BAY_pdf..exe PID 1496 wrote to memory of 912 1496 MV Crystal BAY_pdf..exe MV Crystal BAY_pdf..exe PID 1496 wrote to memory of 912 1496 MV Crystal BAY_pdf..exe MV Crystal BAY_pdf..exe PID 1496 wrote to memory of 912 1496 MV Crystal BAY_pdf..exe MV Crystal BAY_pdf..exe -
outlook_office_path 1 IoCs
Processes:
MV Crystal BAY_pdf..exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MV Crystal BAY_pdf..exe -
outlook_win_path 1 IoCs
Processes:
MV Crystal BAY_pdf..exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MV Crystal BAY_pdf..exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MV Crystal BAY_pdf..exe"C:\Users\Admin\AppData\Local\Temp\MV Crystal BAY_pdf..exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\MV Crystal BAY_pdf..exe"C:\Users\Admin\AppData\Local\Temp\MV Crystal BAY_pdf..exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:912