Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 22:57
Static task
static1
Behavioral task
behavioral1
Sample
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe
Resource
win7-20220812-en
General
-
Target
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe
-
Size
93KB
-
MD5
07f9fa19238527b7a6e78cd8756a3b7b
-
SHA1
88d5ba75674341a8ec58717f0264dcaa3022f467
-
SHA256
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd
-
SHA512
1cb6315a2cdcb9fca504ed9f140520a7a3b2f95b572355c31a04a466edd2ad152d70d2628b59a9c63abbf62131266a4e6452d4284d74759375aa71479120267c
-
SSDEEP
1536:F3wA+4n/6C1QC5s2DnT+HuU8zoUo7KEuk1gNvMNRNj2P0BRdq173vZ4fUKALU2W:F3L3MC5rbT+HN8MUoWCaNvMTNjLDdq1X
Malware Config
Extracted
pony
http://skpoydy.pw:4915/way/like.php
http://sotyksy.pw:4915/way/like.php
Signatures
-
Drops file in Drivers directory 3 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.execmd.exedescription ioc process File created C:\Windows\system32\drivers\etc\tmp.tmp 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe File created C:\Windows\system32\drivers\etc\hosts.sam cmd.exe File opened for modification C:\Windows\system32\drivers\etc\hosts.sam cmd.exe -
Processes:
resource yara_rule behavioral2/memory/5044-134-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/5044-135-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/5044-137-0x0000000000400000-0x0000000000424000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exedescription pid process Token: SeImpersonatePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeTcbPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeChangeNotifyPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeCreateTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeBackupPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeRestorePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeIncreaseQuotaPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeAssignPrimaryTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeImpersonatePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeTcbPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeChangeNotifyPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeCreateTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeBackupPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeRestorePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeIncreaseQuotaPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeAssignPrimaryTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeImpersonatePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeTcbPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeChangeNotifyPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeCreateTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeBackupPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeRestorePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeIncreaseQuotaPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeAssignPrimaryTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeImpersonatePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeTcbPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeChangeNotifyPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeCreateTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeBackupPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeRestorePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeIncreaseQuotaPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeAssignPrimaryTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeImpersonatePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeTcbPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeChangeNotifyPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeCreateTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeBackupPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeRestorePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeIncreaseQuotaPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeAssignPrimaryTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeImpersonatePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeTcbPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeChangeNotifyPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeCreateTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeBackupPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeRestorePrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeIncreaseQuotaPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe Token: SeAssignPrimaryTokenPrivilege 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.execmd.exedescription pid process target process PID 5044 wrote to memory of 2856 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe cmd.exe PID 5044 wrote to memory of 2856 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe cmd.exe PID 5044 wrote to memory of 2856 5044 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe cmd.exe PID 2856 wrote to memory of 2052 2856 cmd.exe at.exe PID 2856 wrote to memory of 2052 2856 cmd.exe at.exe PID 2856 wrote to memory of 2052 2856 cmd.exe at.exe -
outlook_win_path 1 IoCs
Processes:
56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe"C:\Users\Admin\AppData\Local\Temp\56bc0743c8eb9be62b9b0b7195fad34bba3d3428ea78794b4c3a3a358b3d32bd.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\drivers\etc\hosts C:\Windows\system32\drivers\etc\hosts.sam /Y && at 05:20:00 /every:M,T,W,Th,F,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\240596828aq C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeat 05:20:00 /every:M,T,W,Th,F,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\240596828aq C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2052-138-0x0000000000000000-mapping.dmp
-
memory/2856-136-0x0000000000000000-mapping.dmp
-
memory/5044-133-0x0000000002160000-0x0000000002184000-memory.dmpFilesize
144KB
-
memory/5044-132-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5044-134-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5044-135-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5044-137-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB