4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f

General

Target

4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
Size

586KB
MD5

4cd1844f73c8ab6346f0fcac06597c96
SHA1

d72b2af26d479a091492f8840da8caf5b192bb2f
SHA256

4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f
SHA512

eb9bd53e79f7b4a9d81bfde011c6959753551b4c2bd3ae6aebea9ea007c098ca6a37fb2be0db9bb98bd28a7cfc4a0654141bd0378ac22c1eae59aa5a3e95d834
SSDEEP

12288:RlZOn5NPWJAJRBpWHWTGd1Gaibl6TNxN+eo4Nxm/v0GFV:Re5N+JER6XvGaKl6TJV6

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\zGKkIjsiJeYNc1WR\\RMyp4hlGeSiw.exe\",explorer.exe"	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/940-137-0x0000000000400000-0x000000000048C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/940-137-0x0000000000400000-0x000000000048C000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/940-137-0x0000000000400000-0x000000000048C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

89 whatismyipaddress.com

flow	ioc
89	whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

description	pid	process	target process
PID 668 set thread context of 940	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

Processes:

4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4752 EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

pid	process
668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

description	pid	process
Token: SeDebugPrivilege	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
Token: SeDebugPrivilege	940	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

EXCEL.EXE4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

pid	process
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
940	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

description	pid	process	target process
PID 668 wrote to memory of 4752	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	EXCEL.EXE
PID 668 wrote to memory of 4752	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	EXCEL.EXE
PID 668 wrote to memory of 4752	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	EXCEL.EXE
PID 668 wrote to memory of 3608	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
PID 668 wrote to memory of 3608	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
PID 668 wrote to memory of 3608	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
PID 668 wrote to memory of 940	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
PID 668 wrote to memory of 940	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
PID 668 wrote to memory of 940	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
PID 668 wrote to memory of 940	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
PID 668 wrote to memory of 940	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
PID 668 wrote to memory of 940	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
PID 668 wrote to memory of 940	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
PID 668 wrote to memory of 940	668	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe	4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe

C:\Users\Admin\AppData\Local\Temp\4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
"C:\Users\Admin\AppData\Local\Temp\4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Mp0HWlzrSg87QaV8.xls"
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4752

C:\Users\Admin\AppData\Local\Temp\4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
"C:\Users\Admin\AppData\Local\Temp\4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe"
2⤵
PID:3608

C:\Users\Admin\AppData\Local\Temp\4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe
"C:\Users\Admin\AppData\Local\Temp\4dfb6e970cba6f407f300f7aae1194748b6cf3965f589cb215a93a0158d5351f.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mp0HWlzrSg87QaV8.xls
Filesize
32KB

MD5
a4ecc1b737ae3d0acfba6df6c30473f4

SHA1
ce1809cc0006fd5467edddf030cff0e84585fb7c

SHA256
3566715c319f7187edcec6dbd175fd837551a1efbc9aa9e4397915d96e2a12a5

SHA512
6d39e78e8678c1e4701b5471d30f2db2a23cc41d644232a5a3e4b3cc4c1b8122bbbf21d09713f190d463dd153818d266ba397385756a78698fdd24cea1a9f35f

Download Submit
memory/668-132-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/668-133-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/940-136-0x0000000000000000-mapping.dmp

Download
memory/940-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/940-138-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/940-145-0x0000000074780000-0x0000000074D31000-memory.dmp

Filesize
5.7MB

Download
memory/3608-135-0x0000000000000000-mapping.dmp

Download
memory/4752-139-0x00007FFBF2B50000-0x00007FFBF2B60000-memory.dmp

Filesize
64KB

Download
memory/4752-141-0x00007FFBF2B50000-0x00007FFBF2B60000-memory.dmp

Filesize
64KB

Download
memory/4752-142-0x00007FFBF2B50000-0x00007FFBF2B60000-memory.dmp

Filesize
64KB

Download
memory/4752-143-0x00007FFBF2B50000-0x00007FFBF2B60000-memory.dmp

Filesize
64KB

Download
memory/4752-144-0x00007FFBF0290000-0x00007FFBF02A0000-memory.dmp

Filesize
64KB

Download
memory/4752-140-0x00007FFBF2B50000-0x00007FFBF2B60000-memory.dmp

Filesize
64KB

Download
memory/4752-146-0x00007FFBF0290000-0x00007FFBF02A0000-memory.dmp

Filesize
64KB

Download
memory/4752-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads