Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 13:33
Static task
static1
Behavioral task
behavioral1
Sample
4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe
Resource
win7-20220812-en
General
-
Target
4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe
-
Size
78KB
-
MD5
6cff3f00533c9d18561277b8116fcf90
-
SHA1
88dcbf130d1d3fae174dc7eea168fee380f60c6b
-
SHA256
4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9
-
SHA512
e1f87a1d6cf6eca77121136ede30df764191571ce7a5d2fd1561c177e9d402cb42fa6444338a3f9006375578bc88c5c90e0b36a7d5dcb3a6477f5838f685e1ad
-
SSDEEP
1536:wZGUx/YRAQ2XMH6PjCkao5Wxj+6A/3pqj1Sgr4ve+MYfFsMMCtkETN1c:wZGUx/YRAQH6PjCkBxTQj1xVbwsMMkx6
Malware Config
Extracted
pony
http://trippling.com/forum/viewtopic.php
http://beachfrontconcierge.com/forum/viewtopic.php
http://dinneraffairs.com/forum/viewtopic.php
http://douglasvillestorage.com/forum/viewtopic.php
-
payload_url
http://www.kavalevent.com/5TH.exe
http://ihlwholesale.com/uSWiXbH.exe
http://www.sandbox.crownbees.com/9ffyKeM.exe
http://www.splendidhonda.com/wUy1WgTP.exe
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exedescription pid process Token: SeImpersonatePrivilege 2896 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe Token: SeTcbPrivilege 2896 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe Token: SeChangeNotifyPrivilege 2896 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe Token: SeCreateTokenPrivilege 2896 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe Token: SeBackupPrivilege 2896 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe Token: SeRestorePrivilege 2896 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe Token: SeIncreaseQuotaPrivilege 2896 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe Token: SeAssignPrimaryTokenPrivilege 2896 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exepid process 2896 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe -
outlook_win_path 1 IoCs
Processes:
4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe"C:\Users\Admin\AppData\Local\Temp\4fc7d8be7596b06dc84c4c6d3a440dfdf9d5e01a26a007ce8adf47a94c4fe6c9.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_win_path