Analysis
-
max time kernel
126s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 09:56
Static task
static1
Behavioral task
behavioral1
Sample
3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exe
Resource
win10v2004-20220414-en
General
-
Target
3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exe
-
Size
564KB
-
MD5
8581c725f6f67c689a28937690b7edba
-
SHA1
1b7706404eaac00e1150c83f837a6209115264ee
-
SHA256
3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551
-
SHA512
7b96484be7360e494cc16c94bc44f61aa6286e33031cfb4117763dd43c345dd4f609adb1dfc70e27dd6cc95f70a8e808f6b62cdf11edb876ee27c96b06c4d241
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
filename.exefilename.exepid process 1700 filename.exe 1260 filename.exe -
Loads dropped DLL 3 IoCs
Processes:
WScript.exefilename.exepid process 1508 WScript.exe 1508 WScript.exe 1700 filename.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
filename.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook filename.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook filename.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook filename.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Registry Key Name = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder\\filename.vbs" WScript.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
filename.exedescription pid process target process PID 1700 set thread context of 1260 1700 filename.exe filename.exe PID 1700 set thread context of 1260 1700 filename.exe filename.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
filename.exedescription pid process Token: SeDebugPrivilege 1260 filename.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exefilename.exepid process 548 3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exe 1700 filename.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exeWScript.exefilename.exedescription pid process target process PID 548 wrote to memory of 1508 548 3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exe WScript.exe PID 548 wrote to memory of 1508 548 3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exe WScript.exe PID 548 wrote to memory of 1508 548 3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exe WScript.exe PID 548 wrote to memory of 1508 548 3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exe WScript.exe PID 1508 wrote to memory of 1700 1508 WScript.exe filename.exe PID 1508 wrote to memory of 1700 1508 WScript.exe filename.exe PID 1508 wrote to memory of 1700 1508 WScript.exe filename.exe PID 1508 wrote to memory of 1700 1508 WScript.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe PID 1700 wrote to memory of 1260 1700 filename.exe filename.exe -
outlook_office_path 1 IoCs
Processes:
filename.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook filename.exe -
outlook_win_path 1 IoCs
Processes:
filename.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook filename.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exe"C:\Users\Admin\AppData\Local\Temp\3bb34756a2c094cb51e9de7325b34ca0a540ea22c50dfa07e63d408dff194551.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\subfolder\filename.vbs"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe"C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe"C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exeFilesize
564KB
MD58bcecb719f8bc6d9577bfdce03f91733
SHA10e87ce5ac4973a2995d63a345c2d63234bb59182
SHA2567926f16c171339403e61105ea52dafc8c735a1dde615d897edb8f56dbf949f82
SHA512e06abf371f490fca9c47b573fa1a6c15c98167d9c5d27e60d227e8ed78ad7ff93b8e2d25bf0a93648f6559553b3a138dbd1a993bb619fbd43d80ce1564ee0ab7
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exeFilesize
564KB
MD58bcecb719f8bc6d9577bfdce03f91733
SHA10e87ce5ac4973a2995d63a345c2d63234bb59182
SHA2567926f16c171339403e61105ea52dafc8c735a1dde615d897edb8f56dbf949f82
SHA512e06abf371f490fca9c47b573fa1a6c15c98167d9c5d27e60d227e8ed78ad7ff93b8e2d25bf0a93648f6559553b3a138dbd1a993bb619fbd43d80ce1564ee0ab7
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exeFilesize
564KB
MD58bcecb719f8bc6d9577bfdce03f91733
SHA10e87ce5ac4973a2995d63a345c2d63234bb59182
SHA2567926f16c171339403e61105ea52dafc8c735a1dde615d897edb8f56dbf949f82
SHA512e06abf371f490fca9c47b573fa1a6c15c98167d9c5d27e60d227e8ed78ad7ff93b8e2d25bf0a93648f6559553b3a138dbd1a993bb619fbd43d80ce1564ee0ab7
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.vbsFilesize
1024B
MD54edd06f7850d9c0be2933f139defc809
SHA1a9296ee86fa7d35c61b086fce248ff09f79956cf
SHA25655c25ac53f1c1190c200abcb955058f1e766947daff9e4e94160dbccdba1e32c
SHA512fb9597ed5305e3f339e96258c857d4752e1a320706c8410b3f462d09c32d46326c74647621f582412b46179a17494e2f586902482473aab01afff9e5ceb9cf93
-
\Users\Admin\AppData\Local\Temp\subfolder\filename.exeFilesize
564KB
MD58bcecb719f8bc6d9577bfdce03f91733
SHA10e87ce5ac4973a2995d63a345c2d63234bb59182
SHA2567926f16c171339403e61105ea52dafc8c735a1dde615d897edb8f56dbf949f82
SHA512e06abf371f490fca9c47b573fa1a6c15c98167d9c5d27e60d227e8ed78ad7ff93b8e2d25bf0a93648f6559553b3a138dbd1a993bb619fbd43d80ce1564ee0ab7
-
\Users\Admin\AppData\Local\Temp\subfolder\filename.exeFilesize
564KB
MD58bcecb719f8bc6d9577bfdce03f91733
SHA10e87ce5ac4973a2995d63a345c2d63234bb59182
SHA2567926f16c171339403e61105ea52dafc8c735a1dde615d897edb8f56dbf949f82
SHA512e06abf371f490fca9c47b573fa1a6c15c98167d9c5d27e60d227e8ed78ad7ff93b8e2d25bf0a93648f6559553b3a138dbd1a993bb619fbd43d80ce1564ee0ab7
-
\Users\Admin\AppData\Local\Temp\subfolder\filename.exeFilesize
564KB
MD58bcecb719f8bc6d9577bfdce03f91733
SHA10e87ce5ac4973a2995d63a345c2d63234bb59182
SHA2567926f16c171339403e61105ea52dafc8c735a1dde615d897edb8f56dbf949f82
SHA512e06abf371f490fca9c47b573fa1a6c15c98167d9c5d27e60d227e8ed78ad7ff93b8e2d25bf0a93648f6559553b3a138dbd1a993bb619fbd43d80ce1564ee0ab7
-
memory/548-57-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/548-56-0x0000000000280000-0x0000000000286000-memory.dmpFilesize
24KB
-
memory/1260-83-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-80-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-70-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1260-89-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-74-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1260-76-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-77-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-78-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-79-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1260-71-0x00000000004139DE-mapping.dmp
-
memory/1260-81-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-82-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-87-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-84-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-85-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-86-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1260-88-0x0000000000401000-0x00000000004A2000-memory.dmpFilesize
644KB
-
memory/1508-58-0x0000000000000000-mapping.dmp
-
memory/1700-64-0x0000000000000000-mapping.dmp