b9f03efb1bd75e69ea854f15bb0bffc77d8fd67af95daca3b4b7f709ea7441da

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2022, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 28600.exe
Size 665KB
Sample220801-jttygaeca2
SHA256 b9f03efb1bd75e69ea854f15bb0bffc77d8fd67af95daca3b4b7f709ea7441da
MD5 22b73dfdf93db8f4750afbf151c28c3e
SHA1 5806d235710e6c55aefd3c64a5c163f9f8ed3580
SHA512 72289355366b30c738f3ba1fbf062f28ad6c00460dd6db6ea2b0261975d202ec737c249b65cd2cec56cb34cfc08980b8ba6ca85d03b549a3ea7b95ebef74ccbd
MD5 SHA1 SHA512

Score

8^/10

spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
75	4528	cscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	PO 28600.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2328 set thread context of 2464	2328	PO 28600.exe	101
PID 2464 set thread context of 3020	2464	PO 28600.exe	57
PID 4528 set thread context of 3020	4528	cscript.exe	57

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cscript.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2328	PO 28600.exe
2328	PO 28600.exe
2328	PO 28600.exe
2328	PO 28600.exe
2464	PO 28600.exe
2464	PO 28600.exe
2464	PO 28600.exe
2464	PO 28600.exe
2464	PO 28600.exe
2464	PO 28600.exe
2464	PO 28600.exe
2464	PO 28600.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2464	PO 28600.exe
2464	PO 28600.exe
2464	PO 28600.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe
4528	cscript.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	PO 28600.exe
Token: SeDebugPrivilege	2464	PO 28600.exe
Token: SeDebugPrivilege	4528	cscript.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 4612	2328	PO 28600.exe	99
PID 2328 wrote to memory of 4612	2328	PO 28600.exe	99
PID 2328 wrote to memory of 4612	2328	PO 28600.exe	99
PID 2328 wrote to memory of 4844	2328	PO 28600.exe	100
PID 2328 wrote to memory of 4844	2328	PO 28600.exe	100
PID 2328 wrote to memory of 4844	2328	PO 28600.exe	100
PID 2328 wrote to memory of 2464	2328	PO 28600.exe	101
PID 2328 wrote to memory of 2464	2328	PO 28600.exe	101
PID 2328 wrote to memory of 2464	2328	PO 28600.exe	101
PID 2328 wrote to memory of 2464	2328	PO 28600.exe	101
PID 2328 wrote to memory of 2464	2328	PO 28600.exe	101
PID 2328 wrote to memory of 2464	2328	PO 28600.exe	101
PID 3020 wrote to memory of 4528	3020	Explorer.EXE	102
PID 3020 wrote to memory of 4528	3020	Explorer.EXE	102
PID 3020 wrote to memory of 4528	3020	Explorer.EXE	102
PID 4528 wrote to memory of 4948	4528	cscript.exe	105
PID 4528 wrote to memory of 4948	4528	cscript.exe	105
PID 4528 wrote to memory of 4948	4528	cscript.exe	105

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\PO 28600.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 28600.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\PO 28600.exe
    "C:\Users\Admin\AppData\Local\Temp\PO 28600.exe"
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\PO 28600.exe
    "C:\Users\Admin\AppData\Local\Temp\PO 28600.exe"
    3⤵
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\PO 28600.exe
    "C:\Users\Admin\AppData\Local\Temp\PO 28600.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2328-130-0x0000000000040000-0x00000000000EC000-memory.dmp

Download

memory/2328-131-0x0000000004E90000-0x0000000005434000-memory.dmp

Download

memory/2328-132-0x0000000004980000-0x0000000004A12000-memory.dmp

Download

memory/2328-133-0x0000000004A30000-0x0000000004A3A000-memory.dmp

Download

memory/2328-134-0x000000000AAB0000-0x000000000AB4C000-memory.dmp

Download

memory/2328-135-0x000000000AB50000-0x000000000ABB6000-memory.dmp

Download

memory/2464-140-0x0000000001680000-0x00000000019CA000-memory.dmp

Download

memory/2464-145-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2464-139-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2464-142-0x0000000001640000-0x0000000001651000-memory.dmp

Download

memory/3020-152-0x0000000007FF0000-0x000000000815B000-memory.dmp

Download

memory/3020-150-0x0000000007FF0000-0x000000000815B000-memory.dmp

Download

memory/3020-143-0x0000000007E40000-0x0000000007F93000-memory.dmp

Download

memory/4528-146-0x0000000000490000-0x00000000004B7000-memory.dmp

Download

memory/4528-147-0x0000000003430000-0x000000000377A000-memory.dmp

Download

memory/4528-148-0x0000000001350000-0x000000000137D000-memory.dmp

Download

memory/4528-149-0x0000000003310000-0x00000000033A0000-memory.dmp

Download

memory/4528-151-0x0000000001350000-0x000000000137D000-memory.dmp

Download