Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-06-2022 20:26
Static task
static1
Behavioral task
behavioral1
Sample
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe
Resource
win7-20220414-en
General
-
Target
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe
-
Size
825KB
-
MD5
91a939ac483d6fc201bce7807ec673d3
-
SHA1
bd8ba0259c9f69636ac5ff284547232e01dbd888
-
SHA256
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
-
SHA512
41f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
Malware Config
Signatures
-
NirSoft MailPassView 6 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3060-140-0x00000000020C0000-0x0000000002150000-memory.dmp MailPassView behavioral2/memory/2888-161-0x0000000002110000-0x00000000021A0000-memory.dmp MailPassView behavioral2/memory/4156-167-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/4156-168-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4156-170-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4156-171-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3060-140-0x00000000020C0000-0x0000000002150000-memory.dmp WebBrowserPassView behavioral2/memory/2888-161-0x0000000002110000-0x00000000021A0000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3060-140-0x00000000020C0000-0x0000000002150000-memory.dmp Nirsoft behavioral2/memory/2888-161-0x0000000002110000-0x00000000021A0000-memory.dmp Nirsoft behavioral2/memory/4156-167-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4156-168-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4156-170-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4156-171-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 4636 Windows Update.exe 2888 Windows Update.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 43 whatismyipaddress.com 45 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exeWindows Update.exeWindows Update.exedescription pid process target process PID 4756 set thread context of 3060 4756 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe PID 4636 set thread context of 2888 4636 Windows Update.exe Windows Update.exe PID 2888 set thread context of 4156 2888 Windows Update.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Windows Update.exedescription pid process Token: SeDebugPrivilege 2888 Windows Update.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exeWindows Update.exeWindows Update.exepid process 4756 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 4636 Windows Update.exe 2888 Windows Update.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exeWindows Update.exeWindows Update.exedescription pid process target process PID 4756 wrote to memory of 3060 4756 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe PID 4756 wrote to memory of 3060 4756 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe PID 4756 wrote to memory of 3060 4756 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe PID 3060 wrote to memory of 4636 3060 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe Windows Update.exe PID 3060 wrote to memory of 4636 3060 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe Windows Update.exe PID 3060 wrote to memory of 4636 3060 2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe Windows Update.exe PID 4636 wrote to memory of 2888 4636 Windows Update.exe Windows Update.exe PID 4636 wrote to memory of 2888 4636 Windows Update.exe Windows Update.exe PID 4636 wrote to memory of 2888 4636 Windows Update.exe Windows Update.exe PID 2888 wrote to memory of 4156 2888 Windows Update.exe vbc.exe PID 2888 wrote to memory of 4156 2888 Windows Update.exe vbc.exe PID 2888 wrote to memory of 4156 2888 Windows Update.exe vbc.exe PID 2888 wrote to memory of 4156 2888 Windows Update.exe vbc.exe PID 2888 wrote to memory of 4156 2888 Windows Update.exe vbc.exe PID 2888 wrote to memory of 4156 2888 Windows Update.exe vbc.exe PID 2888 wrote to memory of 4156 2888 Windows Update.exe vbc.exe PID 2888 wrote to memory of 4156 2888 Windows Update.exe vbc.exe PID 2888 wrote to memory of 4156 2888 Windows Update.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe"C:\Users\Admin\AppData\Local\Temp\2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exeC:\Users\Admin\AppData\Local\Temp\2f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeC:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
102B
MD54ecc7d5c2f56084e23b78867545e2a66
SHA1c3f5fce1709d1cbd48086fd5adfc0d269790284a
SHA2565713be25e5bd243e1720475f6241bb8a2e0a2af6e7396c876948c365ee4aba7c
SHA512565949e15a350a3b45d498c2ffb9e3de633b046e9017e7bee153e5cde89ca84ae64f4d4b5d431de2e2c15b5e8c5e36b58c47eed5100a85c0dc1c8969709f571a
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
825KB
MD591a939ac483d6fc201bce7807ec673d3
SHA1bd8ba0259c9f69636ac5ff284547232e01dbd888
SHA2562f79996a4e3c810984fdfeb1df611ff3a1b3d6e983fee3111eff8f84f1f60c86
SHA51241f7e94fce592a1a2e2b0e36d04d6cdbb0c19b7ebc6538cebd254ae4baf06e2e52655d8c474b8fb785273d40e8d08e4673c1152f6dfd2da8d62e86c89e743de5
-
memory/2888-173-0x0000000074570000-0x0000000074B21000-memory.dmpFilesize
5.7MB
-
memory/2888-172-0x0000000076F00000-0x00000000770A3000-memory.dmpFilesize
1.6MB
-
memory/2888-165-0x0000000074570000-0x0000000074B21000-memory.dmpFilesize
5.7MB
-
memory/2888-164-0x0000000076F00000-0x00000000770A3000-memory.dmpFilesize
1.6MB
-
memory/2888-161-0x0000000002110000-0x00000000021A0000-memory.dmpFilesize
576KB
-
memory/2888-153-0x0000000000000000-mapping.dmp
-
memory/3060-144-0x0000000076F00000-0x00000000770A3000-memory.dmpFilesize
1.6MB
-
memory/3060-143-0x0000000076F00000-0x00000000770A3000-memory.dmpFilesize
1.6MB
-
memory/3060-152-0x0000000074570000-0x0000000074B21000-memory.dmpFilesize
5.7MB
-
memory/3060-133-0x0000000000000000-mapping.dmp
-
memory/3060-145-0x0000000074570000-0x0000000074B21000-memory.dmpFilesize
5.7MB
-
memory/3060-137-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3060-140-0x00000000020C0000-0x0000000002150000-memory.dmpFilesize
576KB
-
memory/3060-150-0x0000000076F00000-0x00000000770A3000-memory.dmpFilesize
1.6MB
-
memory/4156-167-0x0000000000000000-mapping.dmp
-
memory/4156-168-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4156-170-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4156-171-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4636-155-0x0000000076F00000-0x00000000770A3000-memory.dmpFilesize
1.6MB
-
memory/4636-146-0x0000000000000000-mapping.dmp
-
memory/4756-132-0x0000000002210000-0x0000000002218000-memory.dmpFilesize
32KB
-
memory/4756-134-0x0000000076F00000-0x00000000770A3000-memory.dmpFilesize
1.6MB