Analysis
-
max time kernel
92s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 21:02
Static task
static1
Behavioral task
behavioral1
Sample
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
-
Size
742KB
-
MD5
0546a5de3ee0d82d42e87c6032326b18
-
SHA1
46a7470e3011775d6a704f6a1a9c2cb74e0b1ff5
-
SHA256
1b63db723d1957b88d6199fb5ea958f28de43333d2482a137c5b73b8be78a4a0
-
SHA512
8b13507141d4fd345e55356f0f5244b0de6fa065965e20eb57520932bf6c9a5cfb15c3a700e16d0a1ae783037f2402a5a2aed1d4695ad233611cd85b7d43695b
Malware Config
Extracted
C:\Users\Admin\AppData\Local\F95B724EDE\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exePO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 31 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription pid process target process PID 1604 set thread context of 3384 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exePO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exepid process 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe 3384 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exePO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription pid process Token: SeDebugPrivilege 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe Token: SeDebugPrivilege 3384 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription pid process target process PID 1604 wrote to memory of 4480 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe schtasks.exe PID 1604 wrote to memory of 4480 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe schtasks.exe PID 1604 wrote to memory of 4480 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe schtasks.exe PID 1604 wrote to memory of 3384 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1604 wrote to memory of 3384 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1604 wrote to memory of 3384 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1604 wrote to memory of 3384 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1604 wrote to memory of 3384 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1604 wrote to memory of 3384 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1604 wrote to memory of 3384 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PID 1604 wrote to memory of 3384 1604 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
outlook_office_path 1 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe -
outlook_win_path 1 IoCs
Processes:
PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eZKuuXxaxzyeKr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp13B7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO NOAB1088 Microfinish Valves Pvt Ltd.pdf.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp13B7.tmpFilesize
1KB
MD5ad9f850c6a4efccb680d815a72d00715
SHA1269bbf79851e353fd33843852e2753bc0f20d9e2
SHA256dce09da7a1349b28181e2ed71233afc86d7d9bc7cded9806eb800802fce2771a
SHA51209fee0a1f5703d5977f417dde138d5052a8bbc5ae5bee87cc1eeb4638f8334e40e71d4f322d6550496147a7c9849cbde98fd2ccd35359d0cd480bf9d4da560bf
-
memory/1604-130-0x0000000000CE0000-0x0000000000DA0000-memory.dmpFilesize
768KB
-
memory/1604-131-0x0000000005910000-0x00000000059A2000-memory.dmpFilesize
584KB
-
memory/1604-132-0x0000000005F40000-0x0000000005FDC000-memory.dmpFilesize
624KB
-
memory/1604-133-0x0000000006690000-0x0000000006C34000-memory.dmpFilesize
5.6MB
-
memory/3384-136-0x0000000000000000-mapping.dmp
-
memory/3384-137-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/3384-138-0x00000000058F0000-0x0000000005956000-memory.dmpFilesize
408KB
-
memory/3384-139-0x0000000007420000-0x000000000742A000-memory.dmpFilesize
40KB
-
memory/3384-140-0x00000000074C0000-0x0000000007510000-memory.dmpFilesize
320KB
-
memory/4480-134-0x0000000000000000-mapping.dmp