Analysis
-
max time kernel
88s -
max time network
85s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/11/2022, 08:39
Static task
static1
Behavioral task
behavioral1
Sample
5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe
Resource
win7-20220812-en
General
-
Target
5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe
-
Size
96KB
-
MD5
39a9cf23daed372b013fa8ccf98672e0
-
SHA1
b243eacf498adb158b3421b7cc9c11a64da20364
-
SHA256
5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389
-
SHA512
aa844d7df2494bf5ba9dca55f809169b154988b776a7e9777978b560d5074f722558896ccf09330ae76f5e45376c3504b2086277fcc18077aa6b512304c8a8bd
-
SSDEEP
1536:iPGe2w9/0AMKpNGLsmYTQsLaYbbHAebk54YO/1OYr+4CDn8ATHbLqyam999Nle:i4w9cAM+YYnQCh37bkytrRo/LqyB
Malware Config
Extracted
pony
http://jsdhdje.pw:4915/way/like.php
http://kmyturr.pw:4915/way/like.php
Signatures
-
Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\tmp.tmp 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe File created C:\Windows\system32\drivers\etc\hosts.sam cmd.exe File opened for modification C:\Windows\system32\drivers\etc\hosts.sam cmd.exe -
resource yara_rule behavioral1/memory/1676-57-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1676-58-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1676-59-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1676-61-0x0000000000400000-0x0000000000425000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeTcbPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeChangeNotifyPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeCreateTokenPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeBackupPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeRestorePrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeIncreaseQuotaPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeAssignPrimaryTokenPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeImpersonatePrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeTcbPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeChangeNotifyPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeCreateTokenPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeBackupPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeRestorePrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeIncreaseQuotaPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeAssignPrimaryTokenPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeImpersonatePrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeTcbPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeChangeNotifyPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeCreateTokenPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeBackupPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeRestorePrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeIncreaseQuotaPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeAssignPrimaryTokenPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeImpersonatePrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeTcbPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeChangeNotifyPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeCreateTokenPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeBackupPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeRestorePrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeIncreaseQuotaPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe Token: SeAssignPrimaryTokenPrivilege 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2016 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe 28 PID 1676 wrote to memory of 2016 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe 28 PID 1676 wrote to memory of 2016 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe 28 PID 1676 wrote to memory of 2016 1676 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe 28 PID 2016 wrote to memory of 1752 2016 cmd.exe 30 PID 2016 wrote to memory of 1752 2016 cmd.exe 30 PID 2016 wrote to memory of 1752 2016 cmd.exe 30 PID 2016 wrote to memory of 1752 2016 cmd.exe 30 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe"C:\Users\Admin\AppData\Local\Temp\5e343333d3f9f5af36b93bdef34ef64f47679a1c81e2bfba8527e80e2a34a389.exe"1⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1676 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\drivers\etc\hosts C:\Windows\system32\drivers\etc\hosts.sam /Y && at 09:44:00 /every:M,T,W,Th,F,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\7163378aq C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\at.exeat 09:44:00 /every:M,T,W,Th,F,S,Su cmd.exe "/c attrib -H C:\Windows\system32\drivers\etc\hosts && copy C:\Users\Admin\AppData\Local\Temp\7163378aq C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts"3⤵PID:1752
-
-