Analysis
-
max time kernel
129s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 22:09
Static task
static1
Behavioral task
behavioral1
Sample
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe
Resource
win7-20220812-en
General
-
Target
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe
-
Size
94KB
-
MD5
651d055ebb603ab7f6e10e1681aa585f
-
SHA1
c18c1acf86892ca8f2642f463b7ea9070d24debf
-
SHA256
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d
-
SHA512
e3552c92648d2508e35ec51515b3faeb6bd80851b89ec82297d8b20d556747b0bdafcd6f2f543bf94925b6897f945755cf54f0258018a2461c62eb3ab557e0a0
-
SSDEEP
1536:ebF4YuEyllkUz6zPPhHSbg7QVck8MgYKlV1HVWq:eGnGU2VRsh8Mgf18
Malware Config
Extracted
pony
http://xirukitu.pw:719/way/open.php
http://ckimajuy.pw:719/way/open.php
http://rosatip.pw:719/way/upd
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts.sam cmd.exe File opened for modification C:\Windows\system32\drivers\etc\hosts.sam cmd.exe -
Processes:
resource yara_rule behavioral1/memory/1652-57-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1652-58-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1652-64-0x0000000000400000-0x0000000000426000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription ioc process File created C:\Windows\SelfNotepad.exe dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe File opened for modification C:\Windows\SelfNotepad.exe dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription pid process Token: SeImpersonatePrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeTcbPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeChangeNotifyPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeCreateTokenPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeBackupPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeRestorePrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeIncreaseQuotaPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeAssignPrimaryTokenPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeImpersonatePrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeTcbPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeChangeNotifyPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeCreateTokenPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeBackupPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeRestorePrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeIncreaseQuotaPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeAssignPrimaryTokenPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeImpersonatePrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeTcbPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeChangeNotifyPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeCreateTokenPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeBackupPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeRestorePrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeIncreaseQuotaPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeAssignPrimaryTokenPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeImpersonatePrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeTcbPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeChangeNotifyPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeCreateTokenPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeBackupPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeRestorePrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeIncreaseQuotaPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe Token: SeAssignPrimaryTokenPrivilege 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.execmd.execmd.exedescription pid process target process PID 1652 wrote to memory of 1700 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 1652 wrote to memory of 1700 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 1652 wrote to memory of 1700 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 1652 wrote to memory of 1700 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 1700 wrote to memory of 1704 1700 cmd.exe at.exe PID 1700 wrote to memory of 1704 1700 cmd.exe at.exe PID 1700 wrote to memory of 1704 1700 cmd.exe at.exe PID 1700 wrote to memory of 1704 1700 cmd.exe at.exe PID 1652 wrote to memory of 948 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 1652 wrote to memory of 948 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 1652 wrote to memory of 948 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 1652 wrote to memory of 948 1652 dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe cmd.exe PID 948 wrote to memory of 276 948 cmd.exe PING.EXE PID 948 wrote to memory of 276 948 cmd.exe PING.EXE PID 948 wrote to memory of 276 948 cmd.exe PING.EXE PID 948 wrote to memory of 276 948 cmd.exe PING.EXE -
outlook_win_path 1 IoCs
Processes:
dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe"C:\Users\Admin\AppData\Local\Temp\dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c at 02:07:00 /every:T,M,F,W,Th,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\7209102 C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts" && copy %WINDIR%\system32\drivers\etc\hosts %WINDIR%\system32\drivers\etc\hosts.sam /Y2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeat 02:07:00 /every:T,M,F,W,Th,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\7209102 C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -n 10 localhost && echo deleted>"C:\Users\Admin\AppData\Local\Temp\dba1ef2cf8b88e2970ca31c5c1be2f0077462333c67246875608f715ccf78d1d.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/276-65-0x0000000000000000-mapping.dmp
-
memory/948-63-0x0000000000000000-mapping.dmp
-
memory/1652-54-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1652-55-0x0000000000220000-0x0000000000246000-memory.dmpFilesize
152KB
-
memory/1652-56-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB
-
memory/1652-57-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1652-58-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1652-59-0x0000000000220000-0x0000000000246000-memory.dmpFilesize
152KB
-
memory/1652-64-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1700-60-0x0000000000000000-mapping.dmp
-
memory/1704-61-0x0000000000000000-mapping.dmp