5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982

Analysis

max time kernel
190s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
Size

891KB
MD5

c1fefa5e30a28bde6fb94d7ba38e8871
SHA1

806489a3ce606cf49aae8b10258678e4d642b3c4
SHA256

5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982
SHA512

9031e9bc36a9e652e3f99c758b79be250ea40b07c4ce0a8e65219b01d6de446bf299c26e01f6337b54e74ee9b3016551e10405cc39fc09605a3d63b8d1430bb0

Score

9^/10

collection

Malware Config

Signatures

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2936-148-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/2936-150-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/2936-151-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/2936-152-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1752-141-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1752-143-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1752-144-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1752-145-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

resource	yara_rule
behavioral2/memory/1752-141-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1752-143-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1752-144-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1752-145-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2936-148-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2936-150-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2936-151-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2936-152-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 888 set thread context of 3988	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	88
PID 3988 set thread context of 1752	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	93
PID 3988 set thread context of 2936	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1752	vbc.exe
1752	vbc.exe
1752	vbc.exe
1752	vbc.exe
1752	vbc.exe
1752	vbc.exe
1752	vbc.exe
1752	vbc.exe
1752	vbc.exe
1752	vbc.exe
1752	vbc.exe
1752	vbc.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 4892	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	86
PID 888 wrote to memory of 4892	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	86
PID 888 wrote to memory of 4892	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	86
PID 888 wrote to memory of 3988	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	88
PID 888 wrote to memory of 3988	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	88
PID 888 wrote to memory of 3988	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	88
PID 888 wrote to memory of 3988	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	88
PID 888 wrote to memory of 3988	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	88
PID 888 wrote to memory of 3988	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	88
PID 888 wrote to memory of 3988	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	88
PID 888 wrote to memory of 3988	888	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	88
PID 3988 wrote to memory of 1752	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	93
PID 3988 wrote to memory of 1752	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	93
PID 3988 wrote to memory of 1752	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	93
PID 3988 wrote to memory of 1752	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	93
PID 3988 wrote to memory of 1752	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	93
PID 3988 wrote to memory of 1752	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	93
PID 3988 wrote to memory of 1752	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	93
PID 3988 wrote to memory of 1752	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	93
PID 3988 wrote to memory of 1752	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	93
PID 3988 wrote to memory of 2936	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	95
PID 3988 wrote to memory of 2936	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	95
PID 3988 wrote to memory of 2936	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	95
PID 3988 wrote to memory of 2936	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	95
PID 3988 wrote to memory of 2936	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	95
PID 3988 wrote to memory of 2936	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	95
PID 3988 wrote to memory of 2936	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	95
PID 3988 wrote to memory of 2936	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	95
PID 3988 wrote to memory of 2936	3988	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	95

C:\Users\Admin\AppData\Local\Temp\5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
"C:\Users\Admin\AppData\Local\Temp\5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FbVYyxTrFSsUq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE7A1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4892
- C:\Users\Admin\AppData\Local\Temp\5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
  "C:\Users\Admin\AppData\Local\Temp\5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp9A66.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1752
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp4638.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:2936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe.log

Filesize
500B

MD5
f3bfbe5958adfc86cc0ea0a8317ea113

SHA1
3bf76848af2edafcacee5f9fb6a06b35a6724015

SHA256
598715cafd950c881e4fe318430b5830e95781f2093baa22f124cfad03320874

SHA512
873fb9861d615ec3298ccba8231ea3f2a22f2050fe68fea1a6948987942c04f6b40f0b92d5e59f6971cdb429b67877ac2e3cfc953949a0140e03c6cdb8a1139d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9A66.tmp

Filesize
4KB

MD5
8376e754a86cd9a9461b4a4ae2486b11

SHA1
d0e566622882fde386f482f1dcee15b2c7fa5d3a

SHA256
c02f630d99769ab6a71fec1ee712a8c6a97742e5469b4e4157d5ca716e09e62c

SHA512
a1caf85a93499f37d7451bf9b3ef01cbf833e9371585257c009a5de183d072d46a0b8124a8816e0bd94025a5129ad6fb15738f12a865485a3aff07343a14ec6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE7A1.tmp

Filesize
1KB

MD5
5f3bee096c6fd8a3e15b661c031cabf2

SHA1
cd73c524d7d8b2b75443e0ec55e157061d054eaa

SHA256
845d049043651cc60ff829c4ffd1c84ccbdd2780406d09829430a2af8f1fe696

SHA512
c97ce3853cece20c0ec025d1c06f0bca4cd368556023772a9cbefac068a58bc165f365cfb440dc87995387e9c6637dd6b0001404ee9ae5937a44285335d88056

Download Submit
memory/888-137-0x0000000074DA0000-0x0000000075351000-memory.dmp

Filesize
5.7MB

Download
memory/888-131-0x0000000074DA0000-0x0000000075351000-memory.dmp

Filesize
5.7MB

Download
memory/888-130-0x0000000074DA0000-0x0000000075351000-memory.dmp

Filesize
5.7MB

Download
memory/1752-141-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1752-143-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1752-145-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1752-144-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2936-148-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2936-150-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2936-151-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2936-152-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3988-139-0x0000000074DA0000-0x0000000075351000-memory.dmp

Filesize
5.7MB

Download
memory/3988-138-0x0000000074DA0000-0x0000000075351000-memory.dmp

Filesize
5.7MB

Download