Analysis
-
max time kernel
153s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 09:17
Static task
static1
Behavioral task
behavioral1
Sample
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe
Resource
win7-20221111-en
General
-
Target
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe
-
Size
697KB
-
MD5
343c326e824393b35e3bff033c097a0f
-
SHA1
6d7319e0ccdff67f9811a7a65ad0dacc6867162e
-
SHA256
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
-
SHA512
16cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
SSDEEP
12288:Ic4zJ7hNsViyCPCE2OZtYPIUR1eDGPTja2x6AeL7J:IrJti4PCKEIAIKru2x6AK7
Malware Config
Signatures
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/1840-135-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/1840-135-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView -
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1840-135-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 1140 Windows Update.exe 4924 Windows Update.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Windows Update.exea89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jSILlzCwX = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\VAIO Update.exe\"" Windows Update.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jSILlzCwX = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\VAIO Update.exe\"" a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 60 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exeWindows Update.exedescription pid process target process PID 3984 set thread context of 1840 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 1140 set thread context of 4924 1140 Windows Update.exe Windows Update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exeWindows Update.exepid process 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe 1140 Windows Update.exe 1140 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exeWindows Update.exedescription pid process Token: SeDebugPrivilege 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Token: SeDebugPrivilege 1140 Windows Update.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exea89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exeWindows Update.exedescription pid process target process PID 3984 wrote to memory of 1840 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 3984 wrote to memory of 1840 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 3984 wrote to memory of 1840 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 3984 wrote to memory of 1840 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 3984 wrote to memory of 1840 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 3984 wrote to memory of 1840 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 3984 wrote to memory of 1840 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 3984 wrote to memory of 1840 3984 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 1840 wrote to memory of 1140 1840 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Windows Update.exe PID 1840 wrote to memory of 1140 1840 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Windows Update.exe PID 1840 wrote to memory of 1140 1840 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Windows Update.exe PID 1140 wrote to memory of 4924 1140 Windows Update.exe Windows Update.exe PID 1140 wrote to memory of 4924 1140 Windows Update.exe Windows Update.exe PID 1140 wrote to memory of 4924 1140 Windows Update.exe Windows Update.exe PID 1140 wrote to memory of 4924 1140 Windows Update.exe Windows Update.exe PID 1140 wrote to memory of 4924 1140 Windows Update.exe Windows Update.exe PID 1140 wrote to memory of 4924 1140 Windows Update.exe Windows Update.exe PID 1140 wrote to memory of 4924 1140 Windows Update.exe Windows Update.exe PID 1140 wrote to memory of 4924 1140 Windows Update.exe Windows Update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe"C:\Users\Admin\AppData\Local\Temp\a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe"C:\Users\Admin\AppData\Local\Temp\a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
PID:4924
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe.logFilesize
686B
MD52da5d49e592515901f6adb84aa66860d
SHA137017ffa66b85c8e1d00fa426733caad0887cf61
SHA256b147333035afc91552bb35c2c97a15496204b134877672a18cb1987d2d8d762d
SHA5126151e54e7efcb14d4b7842b9860438e1cd77036b2e61a72025ff204d35e1181130a0d9522f2ff92f3e960d55e6dda95bbadff0aa5e0799bb51c11316e89c9dca
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
102B
MD5af05f065e77521d5b2478c39369b1441
SHA1f38175fd13f3cec255fc00885f6b4b1f0d24c2a4
SHA256cb591bf738d39544be82ec7e64618d879bfbe94afd9dd95fb2359725cbd8773e
SHA5123b0c0c49fdec99ce9aca3602092e99ea9a10d273c783001c840f25375750c7bf93f98e08275f8f5e31da23851b632a68bee83af35308079b903ef0b993954e7a
-
C:\Users\Admin\AppData\Roaming\Microsoft\VAIO Update.exeFilesize
697KB
MD5343c326e824393b35e3bff033c097a0f
SHA16d7319e0ccdff67f9811a7a65ad0dacc6867162e
SHA256a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
SHA51216cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
697KB
MD5343c326e824393b35e3bff033c097a0f
SHA16d7319e0ccdff67f9811a7a65ad0dacc6867162e
SHA256a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
SHA51216cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
697KB
MD5343c326e824393b35e3bff033c097a0f
SHA16d7319e0ccdff67f9811a7a65ad0dacc6867162e
SHA256a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
SHA51216cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
697KB
MD5343c326e824393b35e3bff033c097a0f
SHA16d7319e0ccdff67f9811a7a65ad0dacc6867162e
SHA256a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
SHA51216cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
memory/1140-144-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/1140-139-0x0000000000000000-mapping.dmp
-
memory/1140-149-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/1840-136-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/1840-135-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1840-143-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/1840-138-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/1840-134-0x0000000000000000-mapping.dmp
-
memory/3984-132-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/3984-137-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/3984-133-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/4924-145-0x0000000000000000-mapping.dmp
-
memory/4924-150-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/4924-152-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB