Analysis
-
max time kernel
149s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 00:50
Static task
static1
Behavioral task
behavioral1
Sample
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe
Resource
win7-20220812-en
General
-
Target
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe
-
Size
98KB
-
MD5
6e45317a01df8ec402c4f7d7567d0882
-
SHA1
2a0128427684e525847c9a34722811382cddbb21
-
SHA256
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad
-
SHA512
8e3eaa4b3645263a8610dec8e410f20cdcb01401f7b421976329237c117e6c9154bd85ac2cb8a2f02b4c6e8ac547215aa999c275617e190b410c289964aae821
-
SSDEEP
1536:U8DteyFl41q1dlor984L5028c/GYJ+n6pQjqMgliW92d9veKxjUWoy3JBX7:xDUyF5lor984Lv/XmdgoWsvX13L
Malware Config
Extracted
pony
http://laketys.pw:719/way/open.php
http://voleddak.pw:719/way/open.php
http://vopedala.pw:719/way/upd
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts.sam cmd.exe File opened for modification C:\Windows\system32\drivers\etc\hosts.sam cmd.exe -
Processes:
resource yara_rule behavioral1/memory/668-56-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/668-58-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/668-59-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/668-64-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/668-65-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/668-66-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/668-67-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/668-68-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/668-73-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exedescription pid process target process PID 1932 set thread context of 668 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe -
Drops file in Windows directory 2 IoCs
Processes:
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exedescription ioc process File created C:\Windows\SelfNotepad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe File opened for modification C:\Windows\SelfNotepad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exepid process 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exedescription pid process Token: SeImpersonatePrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeTcbPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeChangeNotifyPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeCreateTokenPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeBackupPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeRestorePrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeIncreaseQuotaPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeAssignPrimaryTokenPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeImpersonatePrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeTcbPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeChangeNotifyPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeCreateTokenPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeBackupPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeRestorePrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeIncreaseQuotaPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeAssignPrimaryTokenPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeImpersonatePrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeTcbPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeChangeNotifyPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeCreateTokenPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeBackupPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeRestorePrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeIncreaseQuotaPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeAssignPrimaryTokenPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeImpersonatePrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeTcbPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeChangeNotifyPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeCreateTokenPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeBackupPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeRestorePrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeIncreaseQuotaPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe Token: SeAssignPrimaryTokenPrivilege 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exepid process 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exeaccc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.execmd.execmd.exetaskeng.execmd.exedescription pid process target process PID 1932 wrote to memory of 668 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe PID 1932 wrote to memory of 668 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe PID 1932 wrote to memory of 668 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe PID 1932 wrote to memory of 668 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe PID 1932 wrote to memory of 668 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe PID 1932 wrote to memory of 668 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe PID 1932 wrote to memory of 668 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe PID 1932 wrote to memory of 668 1932 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe PID 668 wrote to memory of 1844 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe cmd.exe PID 668 wrote to memory of 1844 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe cmd.exe PID 668 wrote to memory of 1844 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe cmd.exe PID 668 wrote to memory of 1844 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe cmd.exe PID 1844 wrote to memory of 524 1844 cmd.exe at.exe PID 1844 wrote to memory of 524 1844 cmd.exe at.exe PID 1844 wrote to memory of 524 1844 cmd.exe at.exe PID 1844 wrote to memory of 524 1844 cmd.exe at.exe PID 668 wrote to memory of 528 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe cmd.exe PID 668 wrote to memory of 528 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe cmd.exe PID 668 wrote to memory of 528 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe cmd.exe PID 668 wrote to memory of 528 668 accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe cmd.exe PID 528 wrote to memory of 1508 528 cmd.exe PING.EXE PID 528 wrote to memory of 1508 528 cmd.exe PING.EXE PID 528 wrote to memory of 1508 528 cmd.exe PING.EXE PID 528 wrote to memory of 1508 528 cmd.exe PING.EXE PID 896 wrote to memory of 1528 896 taskeng.exe cmd.exe PID 896 wrote to memory of 1528 896 taskeng.exe cmd.exe PID 896 wrote to memory of 1528 896 taskeng.exe cmd.exe PID 1528 wrote to memory of 1432 1528 cmd.exe attrib.exe PID 1528 wrote to memory of 1432 1528 cmd.exe attrib.exe PID 1528 wrote to memory of 1432 1528 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
-
outlook_win_path 1 IoCs
Processes:
accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe"C:\Users\Admin\AppData\Local\Temp\accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exeC:\Users\Admin\AppData\Local\Temp\accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c at 07:48:00 /every:T,M,F,W,Th,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\7134861 C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts" && copy %WINDIR%\system32\drivers\etc\hosts %WINDIR%\system32\drivers\etc\hosts.sam /Y3⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeat 07:48:00 /every:T,M,F,W,Th,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\7134861 C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -n 10 localhost && echo deleted>"C:\Users\Admin\AppData\Local\Temp\accc8baa3c71a966f8b597ab43b7968ca8ed85976d963fe6f4cb9bff4e583bad.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
C:\Windows\system32\taskeng.exetaskeng.exe {45FB3D9A-19CC-495A-B022-87D50BE62875} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\7134861 C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib -H C:\Windows\system32\drivers\etc\hosts3⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-70-0x0000000000000000-mapping.dmp
-
memory/528-72-0x0000000000000000-mapping.dmp
-
memory/668-65-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/668-68-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/668-59-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/668-60-0x000000000041B940-mapping.dmp
-
memory/668-73-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/668-64-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/668-55-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/668-66-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/668-67-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/668-58-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/668-56-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1432-76-0x0000000000000000-mapping.dmp
-
memory/1508-74-0x0000000000000000-mapping.dmp
-
memory/1528-75-0x0000000000000000-mapping.dmp
-
memory/1844-69-0x0000000000000000-mapping.dmp
-
memory/1932-54-0x0000000075981000-0x0000000075983000-memory.dmpFilesize
8KB
-
memory/1932-61-0x00000000001E0000-0x00000000001E4000-memory.dmpFilesize
16KB