7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347

General

Target

7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
Size

831KB
MD5

6d7c7e245847b9fd9e5993373bec0000
SHA1

112bfb3c50c103fa8743af3c81e692a29318ceec
SHA256

7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347
SHA512

f851cb1ffc09a577c74fe5be529e17f05060bfd97faefd8df00b4eeb8db672eb72e8e9fe30333da1e995a6480815e640a1d36f64df764fb754cdb5272907af16

Score

9^/10

collection

Malware Config

Signatures

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4160-148-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4160-150-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4160-151-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/504-140-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/504-142-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/504-144-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/504-145-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/504-140-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/504-142-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/504-144-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/504-145-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/4160-148-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4160-150-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4160-151-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

188 bot.whatismyipaddress.com

flow	ioc
188	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

description	pid	process	target process
PID 2924 set thread context of 524	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
PID 524 set thread context of 504	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 set thread context of 4160	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2880 schtasks.exe

pid	process
2880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

vbc.exe7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

pid	process
504	vbc.exe
504	vbc.exe
504	vbc.exe
504	vbc.exe
524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

description pid process

Token: SeDebugPrivilege 524 7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

pid process

524 7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

description	pid	process
Token: SeDebugPrivilege	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

pid	process
524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe

description	pid	process	target process
PID 2924 wrote to memory of 2880	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	schtasks.exe
PID 2924 wrote to memory of 2880	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	schtasks.exe
PID 2924 wrote to memory of 2880	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	schtasks.exe
PID 2924 wrote to memory of 524	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
PID 2924 wrote to memory of 524	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
PID 2924 wrote to memory of 524	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
PID 2924 wrote to memory of 524	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
PID 2924 wrote to memory of 524	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
PID 2924 wrote to memory of 524	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
PID 2924 wrote to memory of 524	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
PID 2924 wrote to memory of 524	2924	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
PID 524 wrote to memory of 504	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 504	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 504	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 504	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 504	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 504	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 504	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 504	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 504	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 4160	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 4160	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 4160	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 4160	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 4160	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 4160	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 4160	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 4160	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe
PID 524 wrote to memory of 4160	524	7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
"C:\Users\Admin\AppData\Local\Temp\7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fRScWE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2CA9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe
  "C:\Users\Admin\AppData\Local\Temp\7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp5A12.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:504
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp5E29.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\7c38161b50bfa0d62fba13ee1daaaad2a86e59fc5e9693dcaccbb29046644347.exe.log

Filesize
405B

MD5
139743cbd3ec3457f6e8f7281f719d7f

SHA1
0f988d72962f1bd8bb354fea75ec222f860ff9b8

SHA256
6f3336b6eb42bd6ebddf810ed9001e7396d8825e4a70005dd6355afc2fd8372a

SHA512
cf2469aac4858a21fd51d6e6bae9123adab6ae02d71133922e3ef9b08a4d4e13a8b5a4e24a782862c7be5567e69eb64cd3219bf2d54852bac5fe87d991bb5cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2CA9.tmp

Filesize
1KB

MD5
8402e0f1bf8001c48abec5128e53e77c

SHA1
0cda1eb6e8bcbb233704c35de705f3a582b3690e

SHA256
71fa8f09f68c437e1ad8cb1bd6a8d59510405460cbcfd5b3c0f859e4dad6d00c

SHA512
e44e5a0475a8885204a92e94c559cb9f732544ff594bcd8e26fae64926e3e5fd6c4ba32e7071f9138ee9073d0a791046d7f620d2c184b1e31c3e3f475cf1b25c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5A12.tmp

Filesize
4KB

MD5
a44410c464bc23ac615f732de976447c

SHA1
e13bb8bfa077dd78dda795b3c21750f217ba4d36

SHA256
a1a6fab77bd9c6713b610b41cb025ba806b8fd64fb80b862e1c44ab2277545a6

SHA512
15e8af0f65161d9ffe068f10083bb2aebfa9be89a36ca6816853f05b58dd05ea46c5abd2f306a354b6ce9eeab20f26a900c6cf3233553bacf168dcbefb79e31a

Download Submit
memory/504-144-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-145-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-142-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-140-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-139-0x0000000000000000-mapping.dmp

Download
memory/524-138-0x0000000075400000-0x00000000759B1000-memory.dmp

Filesize
5.7MB

Download
memory/524-143-0x0000000075400000-0x00000000759B1000-memory.dmp

Filesize
5.7MB

Download
memory/524-134-0x0000000000000000-mapping.dmp

Download
memory/2880-132-0x0000000000000000-mapping.dmp

Download
memory/2924-137-0x0000000075400000-0x00000000759B1000-memory.dmp

Filesize
5.7MB

Download
memory/2924-130-0x0000000075400000-0x00000000759B1000-memory.dmp

Filesize
5.7MB

Download
memory/2924-131-0x0000000075400000-0x00000000759B1000-memory.dmp

Filesize
5.7MB

Download
memory/4160-147-0x0000000000000000-mapping.dmp

Download
memory/4160-148-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4160-150-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4160-151-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads