c837d46a2947aa9bc4c5c85f524c6e7cd796a9d8d97f5e59fc952e396d6b9662

Analysis

max time kernel
131s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 07:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ 1 DESCON - PORD-2022-0461.exe
Size 331KB
Sample221011-jeng5sccb8
SHA256 c837d46a2947aa9bc4c5c85f524c6e7cd796a9d8d97f5e59fc952e396d6b9662
MD5 ec85a368488a7972f2a6977def2c95de
SHA1 0f297811bc7773abf0d8a27f8163fef06633884d
SHA512 78c8f6e579d3d4e7d78c479d4ca440003c05490ff39bb14f6b4c215541fa26a095b68ca0851204067058ff5607c6da3eff9b55b0fcae01395d20445a4a88a3fd
SSDEEP 6144:HNeZmpOPi//S16vVaENu/XugOUtMQY0f2UWjxrCqswIVOjZJW8c:HNlpOPI/S16v+XpOUtMeFUxrCqswRzWL
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4808	pwgggpgbk.exe
3048	pwgggpgbk.exe
2472	pwgggpgbk.exe

Loads dropped DLL 1 IoCs

pid	Process
4792	pwgggpgbk.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pwgggpgbk.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pwgggpgbk.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pwgggpgbk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vVgFC = "C:\\Users\\Admin\\AppData\\Roaming\\vVgFC\\vVgFC.exe"	pwgggpgbk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4808 set thread context of 4792	4808	pwgggpgbk.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	4808	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4792	pwgggpgbk.exe
4792	pwgggpgbk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	pwgggpgbk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4792	pwgggpgbk.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4808	4832	RFQ 1 DESCON - PORD-2022-0461.exe	82
PID 4832 wrote to memory of 4808	4832	RFQ 1 DESCON - PORD-2022-0461.exe	82
PID 4832 wrote to memory of 4808	4832	RFQ 1 DESCON - PORD-2022-0461.exe	82
PID 4808 wrote to memory of 3048	4808	pwgggpgbk.exe	83
PID 4808 wrote to memory of 3048	4808	pwgggpgbk.exe	83
PID 4808 wrote to memory of 3048	4808	pwgggpgbk.exe	83
PID 4808 wrote to memory of 2472	4808	pwgggpgbk.exe	84
PID 4808 wrote to memory of 2472	4808	pwgggpgbk.exe	84
PID 4808 wrote to memory of 2472	4808	pwgggpgbk.exe	84
PID 4808 wrote to memory of 4792	4808	pwgggpgbk.exe	85
PID 4808 wrote to memory of 4792	4808	pwgggpgbk.exe	85
PID 4808 wrote to memory of 4792	4808	pwgggpgbk.exe	85
PID 4808 wrote to memory of 4792	4808	pwgggpgbk.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pwgggpgbk.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	pwgggpgbk.exe

C:\Users\Admin\AppData\Local\Temp\RFQ 1 DESCON - PORD-2022-0461.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 1 DESCON - PORD-2022-0461.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe
  "C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe
    "C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe"
    3⤵
    - Executes dropped EXE
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe
    "C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe"
    3⤵
    - Executes dropped EXE
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe
    "C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe"
    3⤵
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:4792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 484
    3⤵
    - Program crash
    PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4808 -ip 4808
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pwgggpgbk.exe

Path C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe
Size 123KB
SHA256 af60587fb2a03111607b556067cf110d5251fedff34e8b88cb6aaf25237ce8f4
MD5 1c51b6a8ac37013f174fc503adab7b7d
SHA1 0ed45b6afd7a10e0eab848ff9715d3c6c6849068
SHA512 1bd270221efd7544307a2bd3e2ce5e53834736a322ddb70c51a94b1bad4958c0aa892c175da0caa50ef111ca1212b3c3c655d24d143944502ef1a62b80c8a197
SSDEEP 3072:hfWQ6ESTPnrfqkdpz8Co50C5uSlJV6ss8Z:RWhEodpFTC5M8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwgggpgbk.exe

Path C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe
Size 123KB
SHA256 af60587fb2a03111607b556067cf110d5251fedff34e8b88cb6aaf25237ce8f4
MD5 1c51b6a8ac37013f174fc503adab7b7d
SHA1 0ed45b6afd7a10e0eab848ff9715d3c6c6849068
SHA512 1bd270221efd7544307a2bd3e2ce5e53834736a322ddb70c51a94b1bad4958c0aa892c175da0caa50ef111ca1212b3c3c655d24d143944502ef1a62b80c8a197
SSDEEP 3072:hfWQ6ESTPnrfqkdpz8Co50C5uSlJV6ss8Z:RWhEodpFTC5M8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwgggpgbk.exe

Path C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe
Size 123KB
SHA256 af60587fb2a03111607b556067cf110d5251fedff34e8b88cb6aaf25237ce8f4
MD5 1c51b6a8ac37013f174fc503adab7b7d
SHA1 0ed45b6afd7a10e0eab848ff9715d3c6c6849068
SHA512 1bd270221efd7544307a2bd3e2ce5e53834736a322ddb70c51a94b1bad4958c0aa892c175da0caa50ef111ca1212b3c3c655d24d143944502ef1a62b80c8a197
SSDEEP 3072:hfWQ6ESTPnrfqkdpz8Co50C5uSlJV6ss8Z:RWhEodpFTC5M8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwgggpgbk.exe

Path C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe
Size 123KB
SHA256 af60587fb2a03111607b556067cf110d5251fedff34e8b88cb6aaf25237ce8f4
MD5 1c51b6a8ac37013f174fc503adab7b7d
SHA1 0ed45b6afd7a10e0eab848ff9715d3c6c6849068
SHA512 1bd270221efd7544307a2bd3e2ce5e53834736a322ddb70c51a94b1bad4958c0aa892c175da0caa50ef111ca1212b3c3c655d24d143944502ef1a62b80c8a197
SSDEEP 3072:hfWQ6ESTPnrfqkdpz8Co50C5uSlJV6ss8Z:RWhEodpFTC5M8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwgggpgbk.exe

Path C:\Users\Admin\AppData\Local\Temp\pwgggpgbk.exe
Size 123KB
SHA256 af60587fb2a03111607b556067cf110d5251fedff34e8b88cb6aaf25237ce8f4
MD5 1c51b6a8ac37013f174fc503adab7b7d
SHA1 0ed45b6afd7a10e0eab848ff9715d3c6c6849068
SHA512 1bd270221efd7544307a2bd3e2ce5e53834736a322ddb70c51a94b1bad4958c0aa892c175da0caa50ef111ca1212b3c3c655d24d143944502ef1a62b80c8a197
SSDEEP 3072:hfWQ6ESTPnrfqkdpz8Co50C5uSlJV6ss8Z:RWhEodpFTC5M8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ryffj.zd

Path C:\Users\Admin\AppData\Local\Temp\ryffj.zd
Size 4KB
SHA256 0d6cd9afdef1ade70a0d106e89c285c250abe8521ffabd9098937546174becf6
MD5 5a59f1ad2a93c74b43818f96698226b3
SHA1 192a1b0b3db0863345d124bd3bbbfdad9adc06e9
SHA512 7fc74a0659fe1c4570e81584eb760c80e5c26c639b0bd85c60f482d1fb5346757ba46de7b457aad2a21f56efda703164d85f3db6a3e03e46980574dfb1225f50
SSDEEP 96:rizuz6m9p1faUr72qfIvWCWwDM3rdsOeJDp9FdRtjP:rBBDrbwvWCWwDAdsbJDp9FV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucxtns.h

Path C:\Users\Admin\AppData\Local\Temp\ucxtns.h
Size 287KB
SHA256 b3339a214df57f958f4e479a4152639f7c800d38e1b20024671391741f16780c
MD5 de1e5d68369888493afdac8a03845565
SHA1 ce94b03758cd092e46b602cd890343f5320a7cd4
SHA512 0df151214b44d4ce970ada85db70779c81b3b6b15b6fbea9e94467362e71d87776ad1e040f5f384c23ffd9e2d1a41d896c97070bcd6146abcb288404c4c71e0b
SSDEEP 6144:mhHF2pFQtIw4SbpZ4R5MCPNyjNOA9xRALi18cqg0/:+HFhmRSbMR6my5OA9TALiqcqg0/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4792-141-0x0000000005EB0000-0x0000000006454000-memory.dmp

Download

memory/4792-142-0x00000000059A0000-0x0000000005A3C000-memory.dmp

Download

memory/4792-143-0x00000000068A0000-0x0000000006906000-memory.dmp

Download

memory/4792-144-0x0000000006C70000-0x0000000006CC0000-memory.dmp

Download

memory/4792-145-0x00000000074E0000-0x0000000007572000-memory.dmp

Download

memory/4792-146-0x00000000074B0000-0x00000000074BA000-memory.dmp

Download