Analysis
-
max time kernel
98s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 22:57
Static task
static1
Behavioral task
behavioral1
Sample
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe
Resource
win7-20220812-en
General
-
Target
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe
-
Size
93KB
-
MD5
07f9fa19238527b7a6e78cd8756a3b7b
-
SHA1
88d5ba75674341a8ec58717f0264dcaa3022f467
-
SHA256
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd
-
SHA512
1cb6315a2cdcb9fca504ed9f140520a7a3b2f95b572355c31a04a466edd2ad152d70d2628b59a9c63abbf62131266a4e6452d4284d74759375aa71479120267c
-
SSDEEP
1536:F3wA+4n/6C1QC5s2DnT+HuU8zoUo7KEuk1gNvMNRNj2P0BRdq173vZ4fUKALU2W:F3L3MC5rbT+HN8MUoWCaNvMTNjLDdq1X
Malware Config
Extracted
pony
http://skpoydy.pw:4915/way/like.php
http://sotyksy.pw:4915/way/like.php
Signatures
-
Drops file in Drivers directory 3 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.execmd.exedescription ioc process File created C:\Windows\system32\drivers\etc\tmp.tmp 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe File created C:\Windows\system32\drivers\etc\hosts.sam cmd.exe File opened for modification C:\Windows\system32\drivers\etc\hosts.sam cmd.exe -
Processes:
resource yara_rule behavioral1/memory/1628-55-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/1628-58-0x0000000000400000-0x0000000000424000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exedescription pid process Token: SeImpersonatePrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeTcbPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeChangeNotifyPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeCreateTokenPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeBackupPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeRestorePrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeIncreaseQuotaPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeAssignPrimaryTokenPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeImpersonatePrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeTcbPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeChangeNotifyPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeCreateTokenPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeBackupPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeRestorePrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeIncreaseQuotaPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeAssignPrimaryTokenPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeImpersonatePrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeTcbPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeChangeNotifyPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeCreateTokenPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeBackupPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeRestorePrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeIncreaseQuotaPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeAssignPrimaryTokenPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeImpersonatePrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeTcbPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeChangeNotifyPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeCreateTokenPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeBackupPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeRestorePrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeIncreaseQuotaPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeAssignPrimaryTokenPrivilege 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.execmd.exedescription pid process target process PID 1628 wrote to memory of 1900 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe cmd.exe PID 1628 wrote to memory of 1900 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe cmd.exe PID 1628 wrote to memory of 1900 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe cmd.exe PID 1628 wrote to memory of 1900 1628 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe cmd.exe PID 1900 wrote to memory of 1028 1900 cmd.exe at.exe PID 1900 wrote to memory of 1028 1900 cmd.exe at.exe PID 1900 wrote to memory of 1028 1900 cmd.exe at.exe PID 1900 wrote to memory of 1028 1900 cmd.exe at.exe -
outlook_win_path 1 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe"C:\Users\Admin\AppData\Local\Temp\56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe"1⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\drivers\etc\hosts C:\Windows\system32\drivers\etc\hosts.sam /Y && at 05:20:00 /every:M,T,W,Th,F,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\7194391aq C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeat 05:20:00 /every:M,T,W,Th,F,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\7194391aq C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1028-59-0x0000000000000000-mapping.dmp
-
memory/1628-54-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1628-55-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1628-56-0x0000000000220000-0x0000000000244000-memory.dmpFilesize
144KB
-
memory/1628-58-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1900-57-0x0000000000000000-mapping.dmp