Analysis
-
max time kernel
188s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 16:08
Static task
static1
Behavioral task
behavioral1
Sample
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe
Resource
win7-20220715-en
General
-
Target
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe
-
Size
883KB
-
MD5
621bbd51e44db9b507a911ceba8c6e4d
-
SHA1
524a771f04ee76bddc16d5a6c0d59ac4f97b3398
-
SHA256
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31
-
SHA512
b33de89cbebe427ee84e6b4ecc08e7635b6fa01f37a85f87c571d804db69774eb7df5fe623d262b195a59fb78a267daab8f636278599484c231be2905d9fe3c8
Malware Config
Signatures
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/208-143-0x0000000000800000-0x0000000000884000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/208-143-0x0000000000800000-0x0000000000884000-memory.dmp WebBrowserPassView -
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral2/memory/208-143-0x0000000000800000-0x0000000000884000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
Project224.exeProject224.exepid process 4484 Project224.exe 208 Project224.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Project224.exeProject224.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\Documents\\Project224.exe -boot" Project224.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Project224.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 39 whatismyipaddress.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Project224.exedescription pid process target process PID 4484 set thread context of 208 4484 Project224.exe Project224.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exeProject224.exeProject224.exedescription pid process Token: SeDebugPrivilege 2192 5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe Token: SeDebugPrivilege 4484 Project224.exe Token: SeDebugPrivilege 208 Project224.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Project224.exepid process 208 Project224.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.execmd.exeProject224.exedescription pid process target process PID 2192 wrote to memory of 3232 2192 5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe cmd.exe PID 2192 wrote to memory of 3232 2192 5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe cmd.exe PID 2192 wrote to memory of 3232 2192 5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe cmd.exe PID 2192 wrote to memory of 2420 2192 5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe cmd.exe PID 2192 wrote to memory of 2420 2192 5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe cmd.exe PID 2192 wrote to memory of 2420 2192 5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe cmd.exe PID 2420 wrote to memory of 4484 2420 cmd.exe Project224.exe PID 2420 wrote to memory of 4484 2420 cmd.exe Project224.exe PID 2420 wrote to memory of 4484 2420 cmd.exe Project224.exe PID 4484 wrote to memory of 208 4484 Project224.exe Project224.exe PID 4484 wrote to memory of 208 4484 Project224.exe Project224.exe PID 4484 wrote to memory of 208 4484 Project224.exe Project224.exe PID 4484 wrote to memory of 208 4484 Project224.exe Project224.exe PID 4484 wrote to memory of 208 4484 Project224.exe Project224.exe PID 4484 wrote to memory of 208 4484 Project224.exe Project224.exe PID 4484 wrote to memory of 208 4484 Project224.exe Project224.exe PID 4484 wrote to memory of 208 4484 Project224.exe Project224.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe"C:\Users\Admin\AppData\Local\Temp\5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe" "C:\Users\Admin\Documents\Project224.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Documents\Project224.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Project224.exe"C:\Users\Admin\Documents\Project224.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Project224.exe"C:\Users\Admin\Documents\Project224.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\Project224.exeFilesize
883KB
MD5621bbd51e44db9b507a911ceba8c6e4d
SHA1524a771f04ee76bddc16d5a6c0d59ac4f97b3398
SHA2565568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31
SHA512b33de89cbebe427ee84e6b4ecc08e7635b6fa01f37a85f87c571d804db69774eb7df5fe623d262b195a59fb78a267daab8f636278599484c231be2905d9fe3c8
-
C:\Users\Admin\Documents\Project224.exeFilesize
883KB
MD5621bbd51e44db9b507a911ceba8c6e4d
SHA1524a771f04ee76bddc16d5a6c0d59ac4f97b3398
SHA2565568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31
SHA512b33de89cbebe427ee84e6b4ecc08e7635b6fa01f37a85f87c571d804db69774eb7df5fe623d262b195a59fb78a267daab8f636278599484c231be2905d9fe3c8
-
C:\Users\Admin\Documents\Project224.exeFilesize
883KB
MD5621bbd51e44db9b507a911ceba8c6e4d
SHA1524a771f04ee76bddc16d5a6c0d59ac4f97b3398
SHA2565568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31
SHA512b33de89cbebe427ee84e6b4ecc08e7635b6fa01f37a85f87c571d804db69774eb7df5fe623d262b195a59fb78a267daab8f636278599484c231be2905d9fe3c8
-
memory/208-143-0x0000000000800000-0x0000000000884000-memory.dmpFilesize
528KB
-
memory/208-144-0x0000000005040000-0x0000000005096000-memory.dmpFilesize
344KB
-
memory/208-140-0x0000000000000000-mapping.dmp
-
memory/208-145-0x0000000000C60000-0x0000000000CC6000-memory.dmpFilesize
408KB
-
memory/2192-133-0x0000000005310000-0x000000000531A000-memory.dmpFilesize
40KB
-
memory/2192-130-0x0000000000310000-0x00000000003F6000-memory.dmpFilesize
920KB
-
memory/2192-132-0x0000000004E10000-0x0000000004EA2000-memory.dmpFilesize
584KB
-
memory/2192-131-0x0000000005320000-0x00000000058C4000-memory.dmpFilesize
5.6MB
-
memory/2420-135-0x0000000000000000-mapping.dmp
-
memory/3232-134-0x0000000000000000-mapping.dmp
-
memory/4484-136-0x0000000000000000-mapping.dmp
-
memory/4484-139-0x00000000056C0000-0x000000000575C000-memory.dmpFilesize
624KB