Analysis
-
max time kernel
64s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 19:47
Static task
static1
Behavioral task
behavioral1
Sample
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe
Resource
win7-20220414-en
General
-
Target
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe
-
Size
756KB
-
MD5
bd91a8ac0f31d7717bb654a398e92b59
-
SHA1
722a0604c3709b7713114f934bde6730c4538d7a
-
SHA256
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0
-
SHA512
a08aa1e05afdcabda6e18a7df5f93c6a35109d8f3344cf3e1160a0c7f62a82e82ad0330cf63635c2d83d5aa62442cc66faaef3053d71b3f9bfbc7989e68cc07f
Malware Config
Extracted
pony
http://198.27.98.247/Pony/gate.php
Signatures
-
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
-
suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
-
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
Executes dropped EXE 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exepid process 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription pid process target process PID 3800 set thread context of 912 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exepid process 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription pid process Token: SeDebugPrivilege 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeImpersonatePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeTcbPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeChangeNotifyPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeCreateTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeBackupPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeRestorePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeIncreaseQuotaPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeAssignPrimaryTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeImpersonatePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeTcbPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeChangeNotifyPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeCreateTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeBackupPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeRestorePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeIncreaseQuotaPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeAssignPrimaryTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeImpersonatePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeTcbPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeChangeNotifyPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeCreateTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeBackupPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeRestorePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeIncreaseQuotaPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeAssignPrimaryTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeImpersonatePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeTcbPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeChangeNotifyPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeCreateTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeBackupPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeRestorePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeIncreaseQuotaPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeAssignPrimaryTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeImpersonatePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeTcbPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeChangeNotifyPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeCreateTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeBackupPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeRestorePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeIncreaseQuotaPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeAssignPrimaryTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeImpersonatePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeTcbPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeChangeNotifyPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeCreateTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeBackupPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeRestorePrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeIncreaseQuotaPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe Token: SeAssignPrimaryTokenPrivilege 912 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription pid process target process PID 3800 wrote to memory of 912 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 3800 wrote to memory of 912 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 3800 wrote to memory of 912 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 3800 wrote to memory of 912 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 3800 wrote to memory of 912 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 3800 wrote to memory of 912 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 3800 wrote to memory of 912 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe PID 3800 wrote to memory of 912 3800 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe -
outlook_win_path 1 IoCs
Processes:
45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe"C:\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe"C:\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exeFilesize
756KB
MD5bd91a8ac0f31d7717bb654a398e92b59
SHA1722a0604c3709b7713114f934bde6730c4538d7a
SHA25645fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0
SHA512a08aa1e05afdcabda6e18a7df5f93c6a35109d8f3344cf3e1160a0c7f62a82e82ad0330cf63635c2d83d5aa62442cc66faaef3053d71b3f9bfbc7989e68cc07f
-
memory/912-131-0x0000000000000000-mapping.dmp
-
memory/912-132-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/912-133-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/912-134-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/912-138-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/912-139-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/3800-130-0x0000000074780000-0x0000000074D31000-memory.dmpFilesize
5.7MB