Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 13:06
Static task
static1
Behavioral task
behavioral1
Sample
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe
Resource
win10v2004-20221111-en
General
-
Target
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe
-
Size
537KB
-
MD5
6eea4637a917ac8b4a5965f7b789c3c8
-
SHA1
7b1ae62323ceaecf8c52e0e40016d8224f4eca0e
-
SHA256
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787
-
SHA512
8589114d48f29efc0eb5299452847a90e449db477d0cf297b5ca8724d39c8eb4bc5e73ca593bb9985f3dac12420ae892e1154fcce37509beec4f2fccafcef6de
-
SSDEEP
12288:071HbqID8zy1coOwSOqwbk/Da22Uy77Gr3SyPI4jUWpD9:OOXo4DCnKrmkt7
Malware Config
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1188-91-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1188-92-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1188-95-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1188-96-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1188-99-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
Nirsoft 9 IoCs
Processes:
resource yara_rule behavioral1/memory/612-79-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/612-80-0x000000000040E7FA-mapping.dmp Nirsoft behavioral1/memory/612-85-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/612-87-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/1188-91-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1188-92-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1188-95-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1188-96-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1188-99-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
Loads dropped DLL 1 IoCs
Processes:
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exepid process 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WinApp\\GoogleUpdate.exe.lnk" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exea6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exedescription pid process target process PID 1192 set thread context of 1680 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe PID 1680 set thread context of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 set thread context of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exepid process 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exea6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exedescription pid process Token: SeDebugPrivilege 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe Token: 33 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe Token: SeIncBasePriorityPrivilege 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe Token: SeDebugPrivilege 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exepid process 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.execmd.exea6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exedescription pid process target process PID 1192 wrote to memory of 472 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe cmd.exe PID 1192 wrote to memory of 472 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe cmd.exe PID 1192 wrote to memory of 472 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe cmd.exe PID 1192 wrote to memory of 472 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe cmd.exe PID 472 wrote to memory of 1500 472 cmd.exe reg.exe PID 472 wrote to memory of 1500 472 cmd.exe reg.exe PID 472 wrote to memory of 1500 472 cmd.exe reg.exe PID 472 wrote to memory of 1500 472 cmd.exe reg.exe PID 1192 wrote to memory of 1680 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe PID 1192 wrote to memory of 1680 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe PID 1192 wrote to memory of 1680 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe PID 1192 wrote to memory of 1680 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe PID 1192 wrote to memory of 1680 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe PID 1192 wrote to memory of 1680 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe PID 1192 wrote to memory of 1680 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe PID 1192 wrote to memory of 1680 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe PID 1192 wrote to memory of 1680 1192 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe PID 1680 wrote to memory of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 612 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 1672 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe cmd.exe PID 1680 wrote to memory of 1672 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe cmd.exe PID 1680 wrote to memory of 1672 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe cmd.exe PID 1680 wrote to memory of 1672 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe cmd.exe PID 1680 wrote to memory of 2044 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe WScript.exe PID 1680 wrote to memory of 2044 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe WScript.exe PID 1680 wrote to memory of 2044 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe WScript.exe PID 1680 wrote to memory of 2044 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe WScript.exe PID 1680 wrote to memory of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe PID 1680 wrote to memory of 1188 1680 a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe"C:\Users\Admin\AppData\Local\Temp\a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "GoogleUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe.lnk"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "GoogleUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe.lnk"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe"C:\Users\Admin\AppData\Local\Temp\a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe"2⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\logff.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe" "C:\Users\Admin\AppData\Roaming\a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exe" /y3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mRef.vbs"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\logmail.txt"3⤵
- Accesses Microsoft Outlook accounts
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\logff.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\mRef.vbsFilesize
476B
MD5c0ba376bb94c6da63a36deb055d87000
SHA1ea872dcd8edb96fd03505a02a0bf55e1953a36e9
SHA2560a994c9a6d8a0c5ac9c8d02ca9e8608f658629eaac1dc9d9e4aeb5dfacce6ad4
SHA5126da41ef918b55851bf47fe0dd93dce7bbe12ef195409fd4085770a9cb749741d0616dbe35722e8fbb8c7d1918b1513bf921ee4e475192712de35c5f024351c5a
-
C:\Users\Admin\AppData\Roaming\a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787.exeFilesize
537KB
MD56eea4637a917ac8b4a5965f7b789c3c8
SHA17b1ae62323ceaecf8c52e0e40016d8224f4eca0e
SHA256a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787
SHA5128589114d48f29efc0eb5299452847a90e449db477d0cf297b5ca8724d39c8eb4bc5e73ca593bb9985f3dac12420ae892e1154fcce37509beec4f2fccafcef6de
-
\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exeFilesize
537KB
MD56eea4637a917ac8b4a5965f7b789c3c8
SHA17b1ae62323ceaecf8c52e0e40016d8224f4eca0e
SHA256a6f9d8513672e7db039e557426899ec5aa49d4544dcf858139487d6b0ae05787
SHA5128589114d48f29efc0eb5299452847a90e449db477d0cf297b5ca8724d39c8eb4bc5e73ca593bb9985f3dac12420ae892e1154fcce37509beec4f2fccafcef6de
-
memory/472-60-0x0000000000000000-mapping.dmp
-
memory/612-80-0x000000000040E7FA-mapping.dmp
-
memory/612-79-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/612-85-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/612-87-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1188-96-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1188-99-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1188-95-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1188-92-0x0000000000411654-mapping.dmp
-
memory/1188-91-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1192-71-0x0000000074280000-0x000000007482B000-memory.dmpFilesize
5.7MB
-
memory/1192-72-0x0000000002356000-0x0000000002367000-memory.dmpFilesize
68KB
-
memory/1192-54-0x0000000074D71000-0x0000000074D73000-memory.dmpFilesize
8KB
-
memory/1192-58-0x0000000002356000-0x0000000002367000-memory.dmpFilesize
68KB
-
memory/1192-57-0x0000000074280000-0x000000007482B000-memory.dmpFilesize
5.7MB
-
memory/1192-56-0x0000000002356000-0x0000000002367000-memory.dmpFilesize
68KB
-
memory/1192-55-0x0000000074280000-0x000000007482B000-memory.dmpFilesize
5.7MB
-
memory/1500-61-0x0000000000000000-mapping.dmp
-
memory/1672-82-0x0000000000000000-mapping.dmp
-
memory/1680-63-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1680-69-0x0000000000451916-mapping.dmp
-
memory/1680-100-0x0000000002266000-0x0000000002277000-memory.dmpFilesize
68KB
-
memory/1680-77-0x0000000073CD0000-0x000000007427B000-memory.dmpFilesize
5.7MB
-
memory/1680-75-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1680-73-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1680-68-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1680-78-0x0000000073CD0000-0x000000007427B000-memory.dmpFilesize
5.7MB
-
memory/1680-66-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1680-65-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1680-97-0x0000000073CD0000-0x000000007427B000-memory.dmpFilesize
5.7MB
-
memory/1680-98-0x0000000002266000-0x0000000002277000-memory.dmpFilesize
68KB
-
memory/1680-62-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2044-86-0x0000000000000000-mapping.dmp