Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 09:12
Static task
static1
Behavioral task
behavioral1
Sample
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe
Resource
win10v2004-20220414-en
General
-
Target
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe
-
Size
1.2MB
-
MD5
403930f107d2434601bdf5ed6c057a05
-
SHA1
674639514389fed43f2288e1a5b0637a53568df3
-
SHA256
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
-
SHA512
efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
awesome.fela@yandex.com - Password:
inJesusname1
Signatures
-
NirSoft MailPassView 6 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\test.exe.exe MailPassView C:\Users\Admin\AppData\Local\Temp\test.exe.exe MailPassView behavioral2/memory/4420-161-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/4420-164-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4420-167-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4420-169-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 7 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\test.exe.exe WebBrowserPassView C:\Users\Admin\AppData\Local\Temp\test.exe.exe WebBrowserPassView behavioral2/memory/1720-162-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/1720-163-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1720-168-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1720-170-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1720-172-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 11 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\test.exe.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\test.exe.exe Nirsoft behavioral2/memory/1720-162-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4420-161-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4420-164-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1720-163-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1720-168-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4420-167-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4420-169-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1720-170-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1720-172-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 3 IoCs
Processes:
test.exe.exefilemgr.scrfilemgr.scrpid process 812 test.exe.exe 4820 filemgr.scr 4220 filemgr.scr -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
WScript.exefilemgr.scrtest.exe.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\filemgr.scr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder\\filemgr.vbs -cc" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe" filemgr.scr Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" test.exe.exe -
Processes:
filemgr.scrdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA filemgr.scr -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
filemgr.scrtest.exe.exedescription pid process target process PID 4820 set thread context of 4220 4820 filemgr.scr filemgr.scr PID 812 set thread context of 1720 812 test.exe.exe vbc.exe PID 812 set thread context of 4420 812 test.exe.exe vbc.exe -
Drops file in Program Files directory 2 IoCs
Processes:
filemgr.scrdescription ioc process File created C:\Program Files (x86)\SCSI Subsystem\scsiss.exe filemgr.scr File opened for modification C:\Program Files (x86)\SCSI Subsystem\scsiss.exe filemgr.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2080 schtasks.exe 4876 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
filemgr.scrtest.exe.exevbc.exepid process 4220 filemgr.scr 4220 filemgr.scr 4220 filemgr.scr 812 test.exe.exe 1720 vbc.exe 1720 vbc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
filemgr.scrpid process 4220 filemgr.scr -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
filemgr.scrpid process 4220 filemgr.scr -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
test.exe.exefilemgr.scrdescription pid process Token: SeDebugPrivilege 812 test.exe.exe Token: SeDebugPrivilege 4220 filemgr.scr -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exefilemgr.scrtest.exe.exepid process 4460 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe 4820 filemgr.scr 812 test.exe.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exefilemgr.scrfilemgr.scrtest.exe.exedescription pid process target process PID 4460 wrote to memory of 812 4460 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe test.exe.exe PID 4460 wrote to memory of 812 4460 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe test.exe.exe PID 4460 wrote to memory of 812 4460 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe test.exe.exe PID 4460 wrote to memory of 4556 4460 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe WScript.exe PID 4460 wrote to memory of 4556 4460 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe WScript.exe PID 4460 wrote to memory of 4556 4460 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe WScript.exe PID 4460 wrote to memory of 4820 4460 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe filemgr.scr PID 4460 wrote to memory of 4820 4460 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe filemgr.scr PID 4460 wrote to memory of 4820 4460 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe filemgr.scr PID 4820 wrote to memory of 4220 4820 filemgr.scr filemgr.scr PID 4820 wrote to memory of 4220 4820 filemgr.scr filemgr.scr PID 4820 wrote to memory of 4220 4820 filemgr.scr filemgr.scr PID 4220 wrote to memory of 2080 4220 filemgr.scr schtasks.exe PID 4220 wrote to memory of 2080 4220 filemgr.scr schtasks.exe PID 4220 wrote to memory of 2080 4220 filemgr.scr schtasks.exe PID 4220 wrote to memory of 4876 4220 filemgr.scr schtasks.exe PID 4220 wrote to memory of 4876 4220 filemgr.scr schtasks.exe PID 4220 wrote to memory of 4876 4220 filemgr.scr schtasks.exe PID 812 wrote to memory of 4420 812 test.exe.exe vbc.exe PID 812 wrote to memory of 4420 812 test.exe.exe vbc.exe PID 812 wrote to memory of 4420 812 test.exe.exe vbc.exe PID 812 wrote to memory of 4420 812 test.exe.exe vbc.exe PID 812 wrote to memory of 4420 812 test.exe.exe vbc.exe PID 812 wrote to memory of 4420 812 test.exe.exe vbc.exe PID 812 wrote to memory of 4420 812 test.exe.exe vbc.exe PID 812 wrote to memory of 4420 812 test.exe.exe vbc.exe PID 812 wrote to memory of 1720 812 test.exe.exe vbc.exe PID 812 wrote to memory of 1720 812 test.exe.exe vbc.exe PID 812 wrote to memory of 1720 812 test.exe.exe vbc.exe PID 812 wrote to memory of 1720 812 test.exe.exe vbc.exe PID 812 wrote to memory of 1720 812 test.exe.exe vbc.exe PID 812 wrote to memory of 1720 812 test.exe.exe vbc.exe PID 812 wrote to memory of 1720 812 test.exe.exe vbc.exe PID 812 wrote to memory of 1720 812 test.exe.exe vbc.exe PID 812 wrote to memory of 1720 812 test.exe.exe vbc.exe PID 812 wrote to memory of 4420 812 test.exe.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe"C:\Users\Admin\AppData\Local\Temp\b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test.exe.exe"C:\Users\Admin\AppData\Local\Temp\test.exe.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.vbs"2⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scr"C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scr" /S2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrC:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scr" /S3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAF2C.tmp"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpCD34.tmp"4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrFilesize
1.2MB
MD5403930f107d2434601bdf5ed6c057a05
SHA1674639514389fed43f2288e1a5b0637a53568df3
SHA256b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
SHA512efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrFilesize
1.2MB
MD5403930f107d2434601bdf5ed6c057a05
SHA1674639514389fed43f2288e1a5b0637a53568df3
SHA256b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
SHA512efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrFilesize
1.2MB
MD5403930f107d2434601bdf5ed6c057a05
SHA1674639514389fed43f2288e1a5b0637a53568df3
SHA256b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
SHA512efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.vbsFilesize
1024B
MD54e980196cd8e8c7a9b012281f1ef7a0a
SHA1b99e0a492a63d9d1434fd9cd47f97ac93ab64ffa
SHA2561d678cd10989ecc6b139d3e7abee2ad5f8fb5e4ac15b43cdd794fea6615c512c
SHA512fbfb264dbbf6f71dc8d550afed476b6dc6994710e94d8594d3643d24be6ad3585cefd87ff143c8e8d5679708b7b0c35a4af25d70bb5a6530b82f51b6a686fe66
-
C:\Users\Admin\AppData\Local\Temp\test.exe.exeFilesize
520KB
MD576cca11696a4dc301f0efab653a07b38
SHA139861a65d4704f33778c217b85a1d80baf4dbe72
SHA2564f98e23f3897db247c1e19108f6cb97b33ecbc83b6a40e76b20e3912c76080c8
SHA512e3f0fa3c46b64d254a86abed97e94b5d438ba211c7b4a57a2baf8692718d44cee5d6d3e6d9fc60efc3d767bf02240bb9ba07b6c4ab83861e5f7e3732ea8d4f7f
-
C:\Users\Admin\AppData\Local\Temp\test.exe.exeFilesize
520KB
MD576cca11696a4dc301f0efab653a07b38
SHA139861a65d4704f33778c217b85a1d80baf4dbe72
SHA2564f98e23f3897db247c1e19108f6cb97b33ecbc83b6a40e76b20e3912c76080c8
SHA512e3f0fa3c46b64d254a86abed97e94b5d438ba211c7b4a57a2baf8692718d44cee5d6d3e6d9fc60efc3d767bf02240bb9ba07b6c4ab83861e5f7e3732ea8d4f7f
-
C:\Users\Admin\AppData\Local\Temp\tmpAF2C.tmpFilesize
1KB
MD5eac26a063c2f289cd1062579b6079073
SHA1b1cd3470849772cbeee47424557212b0e94b1bb4
SHA2568b646dae0c439687ed02f8e5a50dfc7c7a3f994687dc514b9a3c488f86969d52
SHA5121ba80a6466b9f71141e7523986f3bc0cbde95479c1b3a5ba4929be7f4699981727dbcca380e166a1607766b5447fcddae7f466e043774f3b2e806a98bfb5ae29
-
C:\Users\Admin\AppData\Local\Temp\tmpCD34.tmpFilesize
1KB
MD5bd110f9fc6c1a842f1d9b269010b0611
SHA1ef71c062902602faef9b66dcd1cfc9fe5baaf389
SHA2568135c4e4eeaa741f752c0ab8f4ee33e3bb8a0cac5923812234f2e5177d50eb5b
SHA512b8a7943a3126880b26407800bbdad5402c5b0e2aa106e7dbbb35d0cb145ca9de114401573a6aa66042a2e13674cfbcc2981d66b813f9b923fff5302210afba1f
-
memory/812-133-0x0000000000000000-mapping.dmp
-
memory/812-144-0x0000000073A20000-0x0000000073FD1000-memory.dmpFilesize
5.7MB
-
memory/812-145-0x0000000073A20000-0x0000000073FD1000-memory.dmpFilesize
5.7MB
-
memory/1720-172-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1720-163-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1720-168-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1720-162-0x0000000000000000-mapping.dmp
-
memory/1720-170-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2080-157-0x0000000000000000-mapping.dmp
-
memory/4220-153-0x0000000077780000-0x0000000077923000-memory.dmpFilesize
1.6MB
-
memory/4220-150-0x0000000077780000-0x0000000077923000-memory.dmpFilesize
1.6MB
-
memory/4220-155-0x0000000077780000-0x0000000077923000-memory.dmpFilesize
1.6MB
-
memory/4220-156-0x0000000073A20000-0x0000000073FD1000-memory.dmpFilesize
5.7MB
-
memory/4220-147-0x0000000000000000-mapping.dmp
-
memory/4220-151-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4220-154-0x0000000073A20000-0x0000000073FD1000-memory.dmpFilesize
5.7MB
-
memory/4420-161-0x0000000000000000-mapping.dmp
-
memory/4420-164-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4420-167-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4420-169-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4460-132-0x0000000002AE0000-0x0000000002AE6000-memory.dmpFilesize
24KB
-
memory/4460-137-0x0000000077780000-0x0000000077923000-memory.dmpFilesize
1.6MB
-
memory/4556-136-0x0000000000000000-mapping.dmp
-
memory/4820-149-0x0000000077780000-0x0000000077923000-memory.dmpFilesize
1.6MB
-
memory/4820-146-0x0000000077780000-0x0000000077923000-memory.dmpFilesize
1.6MB
-
memory/4820-139-0x0000000000000000-mapping.dmp
-
memory/4876-159-0x0000000000000000-mapping.dmp