Analysis

  • max time kernel
    106s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    30-07-2022 22:01

General

  • Target

    6127569ded7e72a45f8a843a862e2cceb19bc01a747cb09d37e56030843696ce.exe

  • Size

    574KB

  • MD5

    77381d5ad94b32aeb2f376cb2133331f

  • SHA1

    4c015fa42ffd0e1f83a54eb9eb9a34ebfcbed87d

  • SHA256

    6127569ded7e72a45f8a843a862e2cceb19bc01a747cb09d37e56030843696ce

  • SHA512

    308cb210c340c92d756189326982dcbe6e4ae114e2127b9fc1ce67cb689cf630628eeebd68aa95dd646760d6a05845ab6df7bc156762898e7e230ef3eb2286cb

Score
9/10

Malware Config

Signatures

  • NirSoft MailPassView 5 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 10 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6127569ded7e72a45f8a843a862e2cceb19bc01a747cb09d37e56030843696ce.exe
    "C:\Users\Admin\AppData\Local\Temp\6127569ded7e72a45f8a843a862e2cceb19bc01a747cb09d37e56030843696ce.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Users\Admin\AppData\Roaming\file.exe
      "C:\Users\Admin\AppData\Roaming\file.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Users\Admin\AppData\Roaming\file.exe
        "C:\Users\Admin\AppData\Roaming\file.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\\Mail.txt"
          4⤵
          • Accesses Microsoft Outlook accounts
          PID:1804
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\\Web.txt"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Defense Evasion

Scripting

1
T1064

Discovery

System Information Discovery

1
T1082

Collection

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Web.txt
    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • C:\Users\Admin\AppData\Roaming\New text document.txt
    Filesize

    32B

    MD5

    3f34290baf16aedd010ab5e28626ab87

    SHA1

    edf324b7cda834c6762362b099f8690f90f22e3b

    SHA256

    20293f853f0b14967d1cc030d5e36840e09cb50907b327e3b630413108fdb116

    SHA512

    7b2dd857a32c84f765caaf5a4d3110dde9ae673d15482b6d9bc83e594c982f2b7b29024811afc0c181fd0b6d7721197546a303ef0abfc85b1f48178b50350560

  • C:\Users\Admin\AppData\Roaming\file.exe
    Filesize

    574KB

    MD5

    77381d5ad94b32aeb2f376cb2133331f

    SHA1

    4c015fa42ffd0e1f83a54eb9eb9a34ebfcbed87d

    SHA256

    6127569ded7e72a45f8a843a862e2cceb19bc01a747cb09d37e56030843696ce

    SHA512

    308cb210c340c92d756189326982dcbe6e4ae114e2127b9fc1ce67cb689cf630628eeebd68aa95dd646760d6a05845ab6df7bc156762898e7e230ef3eb2286cb

  • C:\Users\Admin\AppData\Roaming\file.exe
    Filesize

    574KB

    MD5

    77381d5ad94b32aeb2f376cb2133331f

    SHA1

    4c015fa42ffd0e1f83a54eb9eb9a34ebfcbed87d

    SHA256

    6127569ded7e72a45f8a843a862e2cceb19bc01a747cb09d37e56030843696ce

    SHA512

    308cb210c340c92d756189326982dcbe6e4ae114e2127b9fc1ce67cb689cf630628eeebd68aa95dd646760d6a05845ab6df7bc156762898e7e230ef3eb2286cb

  • C:\Users\Admin\AppData\Roaming\file.exe
    Filesize

    574KB

    MD5

    77381d5ad94b32aeb2f376cb2133331f

    SHA1

    4c015fa42ffd0e1f83a54eb9eb9a34ebfcbed87d

    SHA256

    6127569ded7e72a45f8a843a862e2cceb19bc01a747cb09d37e56030843696ce

    SHA512

    308cb210c340c92d756189326982dcbe6e4ae114e2127b9fc1ce67cb689cf630628eeebd68aa95dd646760d6a05845ab6df7bc156762898e7e230ef3eb2286cb

  • \Users\Admin\AppData\Roaming\file.exe
    Filesize

    574KB

    MD5

    77381d5ad94b32aeb2f376cb2133331f

    SHA1

    4c015fa42ffd0e1f83a54eb9eb9a34ebfcbed87d

    SHA256

    6127569ded7e72a45f8a843a862e2cceb19bc01a747cb09d37e56030843696ce

    SHA512

    308cb210c340c92d756189326982dcbe6e4ae114e2127b9fc1ce67cb689cf630628eeebd68aa95dd646760d6a05845ab6df7bc156762898e7e230ef3eb2286cb

  • memory/1532-88-0x0000000000525000-0x0000000000536000-memory.dmp
    Filesize

    68KB

  • memory/1532-71-0x0000000000400000-0x000000000047C000-memory.dmp
    Filesize

    496KB

  • memory/1532-74-0x0000000074110000-0x00000000746BB000-memory.dmp
    Filesize

    5.7MB

  • memory/1532-64-0x0000000000400000-0x000000000047C000-memory.dmp
    Filesize

    496KB

  • memory/1532-108-0x0000000000525000-0x0000000000536000-memory.dmp
    Filesize

    68KB

  • memory/1532-73-0x0000000074110000-0x00000000746BB000-memory.dmp
    Filesize

    5.7MB

  • memory/1532-68-0x0000000000400000-0x000000000047C000-memory.dmp
    Filesize

    496KB

  • memory/1804-83-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1804-75-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1804-104-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1804-89-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1804-76-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1804-80-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1804-84-0x0000000000411790-mapping.dmp
  • memory/1804-87-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1804-81-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1804-78-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1916-54-0x0000000075481000-0x0000000075483000-memory.dmp
    Filesize

    8KB

  • memory/1916-55-0x00000000746C0000-0x0000000074C6B000-memory.dmp
    Filesize

    5.7MB

  • memory/1916-61-0x00000000746C0000-0x0000000074C6B000-memory.dmp
    Filesize

    5.7MB

  • memory/1940-99-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/1940-100-0x00000000004439CC-mapping.dmp
  • memory/1940-91-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/1940-93-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/1940-95-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/1940-97-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/1940-107-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/1940-90-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/1940-103-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/1940-105-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/2004-66-0x00000000746C0000-0x0000000074C6B000-memory.dmp
    Filesize

    5.7MB

  • memory/2004-69-0x00000000746C0000-0x0000000074C6B000-memory.dmp
    Filesize

    5.7MB

  • memory/2004-57-0x0000000000000000-mapping.dmp
  • memory/2004-63-0x00000000746C0000-0x0000000074C6B000-memory.dmp
    Filesize

    5.7MB