Analysis
- max time kernel
52s - max time network
72s - platform
windows10-2004_x64 - resource
win10v2004-20220718-en - resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system - submitted
18/07/2022, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe
Resource
win7-20220715-en
windows7-x64
14 signatures
150 seconds
General
- Target 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe
- Size 709KB
- Sample220718-2586msdbfl
- SHA256 22a332d108e6a34b5fc3b0111f092e265ac5e4f37496abeebb4f1753e96bbcfb
- MD5 693eb5e37297c8e654c6dd9db85943c9
- SHA1 292d571906f980b7661fa949d12bd15a6c57d96b
- SHA512 3ada2a3f193e5d593625b49d690e82b99325691878f5de14ee243a3811b620e8fd0a11a3361d41c825a51b20698185443d3c06fa8f0800f52adf01df0dfd07a7
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
pony
C2
-
http://pioneermelilla.com/admin32/secure1/gate.php
Attributes
-
payload_url
http://pioneermelilla.com/admin32/secure1/Omega.exe
Signatures
- suricata: ET MALWARE Possible Graftor EXE Download Common Header Order
suricata: ET MALWARE Possible Graftor EXE Download Common Header Order
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\Control Panel\International\Geo\Nation RegAsm.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts RegAsm.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegAsm.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3672 set thread context of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe Token: SeImpersonatePrivilege 1816 RegAsm.exe Token: SeTcbPrivilege 1816 RegAsm.exe Token: SeChangeNotifyPrivilege 1816 RegAsm.exe Token: SeCreateTokenPrivilege 1816 RegAsm.exe Token: SeBackupPrivilege 1816 RegAsm.exe Token: SeRestorePrivilege 1816 RegAsm.exe Token: SeIncreaseQuotaPrivilege 1816 RegAsm.exe Token: SeAssignPrimaryTokenPrivilege 1816 RegAsm.exe Token: SeImpersonatePrivilege 1816 RegAsm.exe Token: SeTcbPrivilege 1816 RegAsm.exe Token: SeChangeNotifyPrivilege 1816 RegAsm.exe Token: SeCreateTokenPrivilege 1816 RegAsm.exe Token: SeBackupPrivilege 1816 RegAsm.exe Token: SeRestorePrivilege 1816 RegAsm.exe Token: SeIncreaseQuotaPrivilege 1816 RegAsm.exe Token: SeAssignPrimaryTokenPrivilege 1816 RegAsm.exe Token: SeImpersonatePrivilege 1816 RegAsm.exe Token: SeTcbPrivilege 1816 RegAsm.exe Token: SeChangeNotifyPrivilege 1816 RegAsm.exe Token: SeCreateTokenPrivilege 1816 RegAsm.exe Token: SeBackupPrivilege 1816 RegAsm.exe Token: SeRestorePrivilege 1816 RegAsm.exe Token: SeIncreaseQuotaPrivilege 1816 RegAsm.exe Token: SeAssignPrimaryTokenPrivilege 1816 RegAsm.exe Token: SeImpersonatePrivilege 1816 RegAsm.exe Token: SeTcbPrivilege 1816 RegAsm.exe Token: SeChangeNotifyPrivilege 1816 RegAsm.exe Token: SeCreateTokenPrivilege 1816 RegAsm.exe Token: SeBackupPrivilege 1816 RegAsm.exe Token: SeRestorePrivilege 1816 RegAsm.exe Token: SeIncreaseQuotaPrivilege 1816 RegAsm.exe Token: SeAssignPrimaryTokenPrivilege 1816 RegAsm.exe Token: SeImpersonatePrivilege 1816 RegAsm.exe Token: SeTcbPrivilege 1816 RegAsm.exe Token: SeChangeNotifyPrivilege 1816 RegAsm.exe Token: SeCreateTokenPrivilege 1816 RegAsm.exe Token: SeBackupPrivilege 1816 RegAsm.exe Token: SeRestorePrivilege 1816 RegAsm.exe Token: SeIncreaseQuotaPrivilege 1816 RegAsm.exe Token: SeAssignPrimaryTokenPrivilege 1816 RegAsm.exe Token: SeImpersonatePrivilege 1816 RegAsm.exe Token: SeTcbPrivilege 1816 RegAsm.exe Token: SeChangeNotifyPrivilege 1816 RegAsm.exe Token: SeCreateTokenPrivilege 1816 RegAsm.exe Token: SeBackupPrivilege 1816 RegAsm.exe Token: SeRestorePrivilege 1816 RegAsm.exe Token: SeIncreaseQuotaPrivilege 1816 RegAsm.exe Token: SeAssignPrimaryTokenPrivilege 1816 RegAsm.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 3672 wrote to memory of 1816 3672 22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe 77 PID 1816 wrote to memory of 3608 1816 RegAsm.exe 78 PID 1816 wrote to memory of 3608 1816 RegAsm.exe 78 PID 1816 wrote to memory of 3608 1816 RegAsm.exe 78 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe"C:\Users\Admin\AppData\Local\Temp\22A332D108E6A34B5FC3B0111F092E265AC5E4F37496A.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240553968.bat" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "3⤵PID:3608
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\240553968.bat
- Size 94B
- SHA256 936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
- MD5 3880eeb1c736d853eb13b44898b718ab
- SHA1 4eec9d50360cd815211e3c4e6bdd08271b6ec8e6
- SHA512 3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
- MD5 SHA1 SHA512