Analysis

  • max time kernel
    97s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2022 20:52

General

  • Target

    b35c1336a3500ec63601bbf1ea7e62740eaa2dae4ae37dd2f4d3f55fd60aec12.exe

  • Size

    1.5MB

  • MD5

    572b24052c1d26c031b80a52c47d8af6

  • SHA1

    6c2faf8bc87ddc6c326f2d574ba5a5d1caea47d0

  • SHA256

    b35c1336a3500ec63601bbf1ea7e62740eaa2dae4ae37dd2f4d3f55fd60aec12

  • SHA512

    c730ff51c3db83044ad7ea818939112e786da6a4c75f8de923efdec083c0f08c91d3e28e2ef36279e3deaf3fb4c2a49c47f694273ec31e070ef0d0d1b4ead1ff

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b35c1336a3500ec63601bbf1ea7e62740eaa2dae4ae37dd2f4d3f55fd60aec12.exe
    "C:\Users\Admin\AppData\Local\Temp\b35c1336a3500ec63601bbf1ea7e62740eaa2dae4ae37dd2f4d3f55fd60aec12.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Users\Admin\AppData\Local\Temp\b35c1336a3500ec63601bbf1ea7e62740eaa2dae4ae37dd2f4d3f55fd60aec12.exe
      "C:\Users\Admin\AppData\Local\Temp\b35c1336a3500ec63601bbf1ea7e62740eaa2dae4ae37dd2f4d3f55fd60aec12.exe"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:3372
      • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tsd.jar"
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3868
        • C:\Program Files\Java\jre1.8.0_66\bin\java.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.81210737950390797014276406410368221.class
          4⤵
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1020
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7723461666724738664.vbs
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2424
            • C:\Windows\system32\cscript.exe
              cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7723461666724738664.vbs
              6⤵
                PID:1788
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3385685279513011713.vbs
              5⤵
                PID:3112
                • C:\Windows\system32\cscript.exe
                  cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3385685279513011713.vbs
                  6⤵
                    PID:4008
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3668966769008928747.vbs
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3348
                • C:\Windows\system32\cscript.exe
                  cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3668966769008928747.vbs
                  5⤵
                    PID:2096
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6215090486660275181.vbs
                  4⤵
                    PID:1448
                    • C:\Windows\system32\cscript.exe
                      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6215090486660275181.vbs
                      5⤵
                        PID:4324

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

                Filesize

                50B

                MD5

                0a1228956e0d1c1c755f99f391926803

                SHA1

                dec0714c7e8174d497261c5ee32367f585152d25

                SHA256

                75cd23ba0792d4409f0a8fab0712019a1b22c7067ec0f5cbfa6683902c155925

                SHA512

                7426ebf1bc14a0f63bfca9a91233fa8ccf71853d3ecc38dd68f36c015fedb1a5b83622625b26685b25e19b6ac863bb355065c46fbbcc40d11d0fdc0be93b5385

              • C:\Users\Admin\AppData\Local\Temp\Retrive3668966769008928747.vbs

                Filesize

                276B

                MD5

                3bdfd33017806b85949b6faa7d4b98e4

                SHA1

                f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                SHA256

                9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                SHA512

                ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

              • C:\Users\Admin\AppData\Local\Temp\Retrive7723461666724738664.vbs

                Filesize

                276B

                MD5

                3bdfd33017806b85949b6faa7d4b98e4

                SHA1

                f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                SHA256

                9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                SHA512

                ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

              • C:\Users\Admin\AppData\Local\Temp\_0.81210737950390797014276406410368221.class

                Filesize

                241KB

                MD5

                781fb531354d6f291f1ccab48da6d39f

                SHA1

                9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

                SHA256

                97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

                SHA512

                3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2660308776-3705150086-26593515-1000\83aa4cc77f591dfc2374580bbd95f6ba_b975079f-5511-47c1-a87a-f7cd913ae83c

                Filesize

                45B

                MD5

                c8366ae350e7019aefc9d1e6e6a498c6

                SHA1

                5731d8a3e6568a5f2dfbbc87e3db9637df280b61

                SHA256

                11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

                SHA512

                33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tsd.jar

                Filesize

                473KB

                MD5

                7da7000ca39ce69997bbcad56fa8d180

                SHA1

                5178465612c87a838fdfaa03b2148baf05a71768

                SHA256

                9d817b32fd59dbbe3a17f0c73d4be0b3301df89be5389bb2e81532bda93e34f8

                SHA512

                5999a976b75bbc457c1b38fa6e0f8149e9ffeedf3e5895d9b4478ffa94d53bf8d38b1df8aa8238423f6eb5b89c0a4bb36fa342033c6597214d12c6def53887d4

              • memory/1020-184-0x0000000002D40000-0x0000000003D40000-memory.dmp

                Filesize

                16.0MB

              • memory/1020-163-0x0000000002D40000-0x0000000003D40000-memory.dmp

                Filesize

                16.0MB

              • memory/1020-151-0x0000000000000000-mapping.dmp

              • memory/1448-188-0x0000000000000000-mapping.dmp

              • memory/1660-134-0x00000000093F0000-0x000000000948C000-memory.dmp

                Filesize

                624KB

              • memory/1660-130-0x0000000000BA0000-0x0000000000D26000-memory.dmp

                Filesize

                1.5MB

              • memory/1660-133-0x00000000057F0000-0x00000000057FA000-memory.dmp

                Filesize

                40KB

              • memory/1660-132-0x00000000056F0000-0x0000000005782000-memory.dmp

                Filesize

                584KB

              • memory/1660-131-0x0000000005BC0000-0x0000000006164000-memory.dmp

                Filesize

                5.6MB

              • memory/1788-182-0x0000000000000000-mapping.dmp

              • memory/2096-183-0x0000000000000000-mapping.dmp

              • memory/2424-181-0x0000000000000000-mapping.dmp

              • memory/3112-187-0x0000000000000000-mapping.dmp

              • memory/3348-180-0x0000000000000000-mapping.dmp

              • memory/3372-144-0x0000000007220000-0x0000000007270000-memory.dmp

                Filesize

                320KB

              • memory/3372-137-0x0000000005E80000-0x0000000005EE6000-memory.dmp

                Filesize

                408KB

              • memory/3372-136-0x0000000000400000-0x00000000004D6000-memory.dmp

                Filesize

                856KB

              • memory/3372-135-0x0000000000000000-mapping.dmp

              • memory/3868-145-0x0000000002680000-0x0000000003680000-memory.dmp

                Filesize

                16.0MB

              • memory/3868-176-0x0000000002680000-0x0000000003680000-memory.dmp

                Filesize

                16.0MB

              • memory/3868-138-0x0000000000000000-mapping.dmp

              • memory/3868-173-0x0000000002680000-0x0000000003680000-memory.dmp

                Filesize

                16.0MB

              • memory/3868-189-0x0000000002680000-0x0000000003680000-memory.dmp

                Filesize

                16.0MB

              • memory/4008-191-0x0000000000000000-mapping.dmp

              • memory/4324-190-0x0000000000000000-mapping.dmp