Analysis
-
max time kernel
90s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 21:02
Static task
static1
Behavioral task
behavioral1
Sample
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
-
Size
742KB
-
MD5
0546a5de3ee0d82d42e87c6032326b18
-
SHA1
46a7470e3011775d6a704f6a1a9c2cb74e0b1ff5
-
SHA256
1b63db723d1957b88d6199fb5ea958f28de43333d2482a137c5b73b8be78a4a0
-
SHA512
8b13507141d4fd345e55356f0f5244b0de6fa065965e20eb57520932bf6c9a5cfb15c3a700e16d0a1ae783037f2402a5a2aed1d4695ad233611cd85b7d43695b
Malware Config
Extracted
C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription pid process target process PID 1336 set thread context of 1872 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exePO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exepid process 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe 1872 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exePO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription pid process Token: SeDebugPrivilege 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Token: SeDebugPrivilege 1872 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription pid process target process PID 1336 wrote to memory of 1188 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe schtasks.exe PID 1336 wrote to memory of 1188 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe schtasks.exe PID 1336 wrote to memory of 1188 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe schtasks.exe PID 1336 wrote to memory of 1188 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe schtasks.exe PID 1336 wrote to memory of 1872 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1336 wrote to memory of 1872 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1336 wrote to memory of 1872 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1336 wrote to memory of 1872 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1336 wrote to memory of 1872 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1336 wrote to memory of 1872 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1336 wrote to memory of 1872 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1336 wrote to memory of 1872 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1336 wrote to memory of 1872 1336 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
outlook_office_path 1 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
outlook_win_path 1 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eZKuuXxaxzyeKr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD70.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAD70.tmpFilesize
1KB
MD5b4d77110ed142e491903cc7cab02bfa0
SHA10790262d3e6422363a738bd475287cabfbc8938c
SHA256679d2ca8c7c1534feb2c6d54591be7ea98744ca792064443cade59fc59bd279b
SHA5120cc3222a1af60ad54d6ff711652038288ea164be87b1ca8445476853153785979d95ffde3a7faa953d6bc958f32f053ce97c6fecce4784214cff94be4f546872
-
memory/1188-58-0x0000000000000000-mapping.dmp
-
memory/1336-54-0x0000000001040000-0x0000000001100000-memory.dmpFilesize
768KB
-
memory/1336-55-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/1336-56-0x0000000000410000-0x0000000000418000-memory.dmpFilesize
32KB
-
memory/1336-57-0x0000000004FD0000-0x0000000005070000-memory.dmpFilesize
640KB
-
memory/1872-63-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1872-61-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1872-60-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1872-64-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1872-65-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1872-66-0x000000000049419E-mapping.dmp
-
memory/1872-68-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1872-70-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1872-71-0x0000000000550000-0x0000000000594000-memory.dmpFilesize
272KB
-
memory/1872-73-0x00000000004A0000-0x00000000004E0000-memory.dmpFilesize
256KB
-
memory/1872-74-0x0000000000790000-0x00000000007A4000-memory.dmpFilesize
80KB