Analysis
-
max time kernel
175s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14-07-2022 04:26
Static task
static1
Behavioral task
behavioral1
Sample
480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe
Resource
win10v2004-20220414-en
General
-
Target
480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe
-
Size
995KB
-
MD5
3d937c27883d24e31fc90cde09fab6ab
-
SHA1
ca793a183989f3efbf1e45d84799024b97193660
-
SHA256
480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe
-
SHA512
3c96714ba1fc004acba679d6bca87d2c32504a052cff55450999f5f793e4890cc113d7e41d8efe2a7722eadd88fd2d34d0f879c92f4f4dad19e5e7c3bcaad377
Malware Config
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/1888-143-0x0000000000770000-0x00000000007F4000-memory.dmp MailPassView behavioral2/memory/4412-146-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/4412-147-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4412-149-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4412-150-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 6 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/1888-143-0x0000000000770000-0x00000000007F4000-memory.dmp WebBrowserPassView behavioral2/memory/4804-151-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/4804-152-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4804-154-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4804-155-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4804-157-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 10 IoCs
resource yara_rule behavioral2/memory/1888-143-0x0000000000770000-0x00000000007F4000-memory.dmp Nirsoft behavioral2/memory/4412-146-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4412-147-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4412-149-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4412-150-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4804-151-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4804-152-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4804-154-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4804-155-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4804-157-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
pid Process 320 project3319.exe 1888 project3319.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\Desktop\\project3319.exe -boot" project3319.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" project3319.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 44 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 320 set thread context of 1888 320 project3319.exe 88 PID 1888 set thread context of 4412 1888 project3319.exe 91 PID 1888 set thread context of 4804 1888 project3319.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4804 vbc.exe 4804 vbc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4228 480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe Token: SeDebugPrivilege 320 project3319.exe Token: SeDebugPrivilege 1888 project3319.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1888 project3319.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4228 wrote to memory of 3868 4228 480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe 82 PID 4228 wrote to memory of 3868 4228 480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe 82 PID 4228 wrote to memory of 3868 4228 480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe 82 PID 4228 wrote to memory of 2708 4228 480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe 84 PID 4228 wrote to memory of 2708 4228 480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe 84 PID 4228 wrote to memory of 2708 4228 480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe 84 PID 2708 wrote to memory of 320 2708 cmd.exe 86 PID 2708 wrote to memory of 320 2708 cmd.exe 86 PID 2708 wrote to memory of 320 2708 cmd.exe 86 PID 320 wrote to memory of 1888 320 project3319.exe 88 PID 320 wrote to memory of 1888 320 project3319.exe 88 PID 320 wrote to memory of 1888 320 project3319.exe 88 PID 320 wrote to memory of 1888 320 project3319.exe 88 PID 320 wrote to memory of 1888 320 project3319.exe 88 PID 320 wrote to memory of 1888 320 project3319.exe 88 PID 320 wrote to memory of 1888 320 project3319.exe 88 PID 320 wrote to memory of 1888 320 project3319.exe 88 PID 1888 wrote to memory of 4412 1888 project3319.exe 91 PID 1888 wrote to memory of 4412 1888 project3319.exe 91 PID 1888 wrote to memory of 4412 1888 project3319.exe 91 PID 1888 wrote to memory of 4412 1888 project3319.exe 91 PID 1888 wrote to memory of 4412 1888 project3319.exe 91 PID 1888 wrote to memory of 4412 1888 project3319.exe 91 PID 1888 wrote to memory of 4412 1888 project3319.exe 91 PID 1888 wrote to memory of 4412 1888 project3319.exe 91 PID 1888 wrote to memory of 4412 1888 project3319.exe 91 PID 1888 wrote to memory of 4804 1888 project3319.exe 92 PID 1888 wrote to memory of 4804 1888 project3319.exe 92 PID 1888 wrote to memory of 4804 1888 project3319.exe 92 PID 1888 wrote to memory of 4804 1888 project3319.exe 92 PID 1888 wrote to memory of 4804 1888 project3319.exe 92 PID 1888 wrote to memory of 4804 1888 project3319.exe 92 PID 1888 wrote to memory of 4804 1888 project3319.exe 92 PID 1888 wrote to memory of 4804 1888 project3319.exe 92 PID 1888 wrote to memory of 4804 1888 project3319.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe"C:\Users\Admin\AppData\Local\Temp\480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe.exe" "C:\Users\Admin\Desktop\project3319.exe"2⤵PID:3868
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Desktop\project3319.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\Desktop\project3319.exe"C:\Users\Admin\Desktop\project3319.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\Desktop\project3319.exe"C:\Users\Admin\Desktop\project3319.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
PID:4412
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4804
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
Filesize
995KB
MD53d937c27883d24e31fc90cde09fab6ab
SHA1ca793a183989f3efbf1e45d84799024b97193660
SHA256480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe
SHA5123c96714ba1fc004acba679d6bca87d2c32504a052cff55450999f5f793e4890cc113d7e41d8efe2a7722eadd88fd2d34d0f879c92f4f4dad19e5e7c3bcaad377
-
Filesize
995KB
MD53d937c27883d24e31fc90cde09fab6ab
SHA1ca793a183989f3efbf1e45d84799024b97193660
SHA256480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe
SHA5123c96714ba1fc004acba679d6bca87d2c32504a052cff55450999f5f793e4890cc113d7e41d8efe2a7722eadd88fd2d34d0f879c92f4f4dad19e5e7c3bcaad377
-
Filesize
995KB
MD53d937c27883d24e31fc90cde09fab6ab
SHA1ca793a183989f3efbf1e45d84799024b97193660
SHA256480f3b78f4b7673d5c20fa9f1a7a85fd6a982bada97f9a79f92885b313b5c5fe
SHA5123c96714ba1fc004acba679d6bca87d2c32504a052cff55450999f5f793e4890cc113d7e41d8efe2a7722eadd88fd2d34d0f879c92f4f4dad19e5e7c3bcaad377