Analysis
-
max time kernel
127s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-09-2022 09:27
Static task
static1
Behavioral task
behavioral1
Sample
1106658150.exe
Resource
win7-20220901-en
General
-
Target
1106658150.exe
-
Size
2.1MB
-
MD5
f0c0bd9f2464a22b26cd1e59f061c301
-
SHA1
9f4af038778fd91eb409c774c88325d23cf48c26
-
SHA256
0eb58b723318b8746280abd3d278a6325deba933c67d41cf638aa89244d6c3c7
-
SHA512
090872ec9db441be82172fe4b093ec0f6b55183341fea747e8ea66591aa81422e69d2b5d227369b22f7088a7d9d8eeb0fdd0d4818072372032425d2c321e0748
-
SSDEEP
24576:lJ/Q7WLg9oER9uXtIkOrGoJHcuA2yZdwMrl9Je:d
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
1106658150.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook 1106658150.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook 1106658150.exe Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
1106658150.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 1106658150.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 1106658150.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
1106658150.exepid process 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe 1200 1106658150.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1106658150.exedescription pid process Token: SeDebugPrivilege 1200 1106658150.exe -
outlook_office_path 1 IoCs
Processes:
1106658150.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe -
outlook_win_path 1 IoCs
Processes:
1106658150.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1106658150.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1106658150.exe"C:\Users\Admin\AppData\Local\Temp\1106658150.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1200-54-0x00000000003D0000-0x00000000005FA000-memory.dmpFilesize
2.2MB
-
memory/1200-55-0x0000000002090000-0x0000000002108000-memory.dmpFilesize
480KB
-
memory/1200-56-0x000000001B0E0000-0x000000001B186000-memory.dmpFilesize
664KB
-
memory/1200-57-0x0000000000AA0000-0x0000000000AEE000-memory.dmpFilesize
312KB
-
memory/1200-58-0x000000001B520000-0x000000001B56C000-memory.dmpFilesize
304KB
-
memory/1200-59-0x0000000000750000-0x00000000007D0000-memory.dmpFilesize
512KB
-
memory/1200-60-0x0000000000750000-0x00000000007D0000-memory.dmpFilesize
512KB
-
memory/1200-61-0x000000001AEE0000-0x000000001AF54000-memory.dmpFilesize
464KB
-
memory/1200-62-0x000000001AF50000-0x000000001AF5C000-memory.dmpFilesize
48KB
-
memory/1200-63-0x000000001B6B0000-0x000000001B738000-memory.dmpFilesize
544KB