Analysis
-
max time kernel
45s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 19:47
Static task
static1
Behavioral task
behavioral1
Sample
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe
Resource
win7-20220414-en
General
-
Target
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe
-
Size
756KB
-
MD5
bd91a8ac0f31d7717bb654a398e92b59
-
SHA1
722a0604c3709b7713114f934bde6730c4538d7a
-
SHA256
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0
-
SHA512
a08aa1e05afdcabda6e18a7df5f93c6a35109d8f3344cf3e1160a0c7f62a82e82ad0330cf63635c2d83d5aa62442cc66faaef3053d71b3f9bfbc7989e68cc07f
Malware Config
Extracted
pony
http://198.27.98.247/Pony/gate.php
Signatures
-
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
-
suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
-
suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
-
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
Executes dropped EXE 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exepid process 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Loads dropped DLL 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exepid process 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription pid process target process PID 1668 set thread context of 1968 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exepid process 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription pid process Token: SeDebugPrivilege 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeImpersonatePrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeTcbPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeChangeNotifyPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeCreateTokenPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeBackupPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeRestorePrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeIncreaseQuotaPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeAssignPrimaryTokenPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeImpersonatePrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeTcbPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeChangeNotifyPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeCreateTokenPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeBackupPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeRestorePrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeIncreaseQuotaPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeAssignPrimaryTokenPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeImpersonatePrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeTcbPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeChangeNotifyPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeCreateTokenPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeBackupPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeRestorePrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeIncreaseQuotaPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeAssignPrimaryTokenPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeImpersonatePrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeTcbPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeChangeNotifyPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeCreateTokenPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeBackupPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeRestorePrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeIncreaseQuotaPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeAssignPrimaryTokenPrivilege 1968 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription pid process target process PID 1668 wrote to memory of 1968 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 1668 wrote to memory of 1968 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 1668 wrote to memory of 1968 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 1668 wrote to memory of 1968 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 1668 wrote to memory of 1968 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 1668 wrote to memory of 1968 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 1668 wrote to memory of 1968 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 1668 wrote to memory of 1968 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 1668 wrote to memory of 1968 1668 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
outlook_win_path 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe"C:\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe"C:\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exeFilesize
756KB
MD5bd91a8ac0f31d7717bb654a398e92b59
SHA1722a0604c3709b7713114f934bde6730c4538d7a
SHA25645fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0
SHA512a08aa1e05afdcabda6e18a7df5f93c6a35109d8f3344cf3e1160a0c7f62a82e82ad0330cf63635c2d83d5aa62442cc66faaef3053d71b3f9bfbc7989e68cc07f
-
\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exeFilesize
756KB
MD5bd91a8ac0f31d7717bb654a398e92b59
SHA1722a0604c3709b7713114f934bde6730c4538d7a
SHA25645fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0
SHA512a08aa1e05afdcabda6e18a7df5f93c6a35109d8f3344cf3e1160a0c7f62a82e82ad0330cf63635c2d83d5aa62442cc66faaef3053d71b3f9bfbc7989e68cc07f
-
memory/1668-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1668-55-0x0000000073FE0000-0x000000007458B000-memory.dmpFilesize
5.7MB
-
memory/1668-56-0x0000000000246000-0x0000000000257000-memory.dmpFilesize
68KB
-
memory/1968-61-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1968-59-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1968-63-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1968-66-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1968-68-0x000000000041002D-mapping.dmp
-
memory/1968-58-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1968-71-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1968-73-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB