Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 14:28
Static task
static1
Behavioral task
behavioral1
Sample
04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe
Resource
win7-20220812-en
General
-
Target
04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe
-
Size
162KB
-
MD5
0d248e0a41c1da11b7edd7c25e0cda70
-
SHA1
267444ef2f574cc4f6fe398e35de8fb51c6d17bc
-
SHA256
04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665
-
SHA512
95adf4138f8e5ef50601d4847359381c3116cb5d3dacb5182ee04401ce4769a5cc2d551e53d5c892f32d2cb929863c6e8e50e325faf07e63775cd4976d3135fd
-
SSDEEP
1536:z5FnyPehHeSePaZAtgDUhuv+B8RF1JdOIm5S0IX1BZYSxUKwmmmhY1T9F5Pva+gw:3nyW3e+AM2EJxnBdw3uiTL+tyVVO
Malware Config
Extracted
Protocol: smtp- Host:
Smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
Password
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe -
Executes dropped EXE 1 IoCs
pid Process 1960 Microsoftlog.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogin.exe 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe File opened for modification C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogin.exe 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 51 whatismyip.com 53 whatismyip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe Token: SeDebugPrivilege 1960 Microsoftlog.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3472 wrote to memory of 1960 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 79 PID 3472 wrote to memory of 1960 3472 04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe"C:\Users\Admin\AppData\Local\Temp\04978e2d9cc5ba67d4800bdd1a982d8f1c40226aff760e788082369b99d5b665.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\Microsoftlog.exe"C:\Users\Admin\AppData\Local\Temp\Microsoftlog.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD51f5200c4744dc14545459a89654c58d1
SHA12703232ecad2953736f855fe1dc76ad3ee45578c
SHA256dc166d945fcc6e0babb9b89838fc1f613c35caffa1b9b39a50828ce89a638297
SHA512e802ac4ac42d98db86422eb9e2b0f4814b471eec8eb63d5f55286a0575ee9d9918c06bcd846bca26b9c8715923a9f6f63305f13b40bbe603a5ba47ba17c86557
-
Filesize
114KB
MD51f5200c4744dc14545459a89654c58d1
SHA12703232ecad2953736f855fe1dc76ad3ee45578c
SHA256dc166d945fcc6e0babb9b89838fc1f613c35caffa1b9b39a50828ce89a638297
SHA512e802ac4ac42d98db86422eb9e2b0f4814b471eec8eb63d5f55286a0575ee9d9918c06bcd846bca26b9c8715923a9f6f63305f13b40bbe603a5ba47ba17c86557
-
Filesize
8KB
MD592165a2607cb6cf6b13a63d738c434af
SHA1cf7a6dbbce935b9b4447f3bce85e5b3fc1c8c0c0
SHA2562d9187409057c6cdc9b564a49622e4b15002c0a7032b1cbfa938510cfd192727
SHA5124cdd14a666e607ff3b688bf9eba3371a4aff574831cf7cd5220d22c8cd5360e43e89756aadeabb51e7c13c3a2822a861b915ada834158aa0d3b5e75c116c26e3