Analysis
-
max time kernel
150s -
max time network
187s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 13:08
Static task
static1
Behavioral task
behavioral1
Sample
864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe
Resource
win10v2004-20220812-en
General
-
Target
864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe
-
Size
524KB
-
MD5
06cc29e1aa42737cc69ae959c8780f90
-
SHA1
5b0b8056b0b3a53ab31160131f7df0126821a4a0
-
SHA256
864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8
-
SHA512
9dee67aab7c2c928cc1fe0353861d38dca1071a4163203bbea23c7e42057de768e685c05a7fd3a64a2f91c9d071c2d96713750f54c11c44b708d038da4757ae7
-
SSDEEP
12288:AMMMMMMMMMMMMMMMMMMvDMMMMMMMMMMMMMMMMMMmWyW985x6joFCI01PoE4BMGGm:AMMMMMMMMMMMMMMMMMMvDMMMMMMMMMMi
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\PcHealth\\PcHealth.exe,explorer.exe" reg.exe -
NirSoft MailPassView 10 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/428-63-0x0000000000400000-0x000000000048C000-memory.dmp MailPassView behavioral1/memory/428-65-0x0000000000400000-0x000000000048C000-memory.dmp MailPassView behavioral1/memory/428-67-0x0000000000485ABE-mapping.dmp MailPassView behavioral1/memory/428-66-0x0000000000400000-0x000000000048C000-memory.dmp MailPassView behavioral1/memory/428-69-0x0000000000400000-0x000000000048C000-memory.dmp MailPassView behavioral1/memory/428-71-0x0000000000400000-0x000000000048C000-memory.dmp MailPassView behavioral1/memory/824-77-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/824-76-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/824-80-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/824-82-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 6 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/428-63-0x0000000000400000-0x000000000048C000-memory.dmp WebBrowserPassView behavioral1/memory/428-65-0x0000000000400000-0x000000000048C000-memory.dmp WebBrowserPassView behavioral1/memory/428-67-0x0000000000485ABE-mapping.dmp WebBrowserPassView behavioral1/memory/428-66-0x0000000000400000-0x000000000048C000-memory.dmp WebBrowserPassView behavioral1/memory/428-69-0x0000000000400000-0x000000000048C000-memory.dmp WebBrowserPassView behavioral1/memory/428-71-0x0000000000400000-0x000000000048C000-memory.dmp WebBrowserPassView -
Nirsoft 10 IoCs
Processes:
resource yara_rule behavioral1/memory/428-63-0x0000000000400000-0x000000000048C000-memory.dmp Nirsoft behavioral1/memory/428-65-0x0000000000400000-0x000000000048C000-memory.dmp Nirsoft behavioral1/memory/428-67-0x0000000000485ABE-mapping.dmp Nirsoft behavioral1/memory/428-66-0x0000000000400000-0x000000000048C000-memory.dmp Nirsoft behavioral1/memory/428-69-0x0000000000400000-0x000000000048C000-memory.dmp Nirsoft behavioral1/memory/428-71-0x0000000000400000-0x000000000048C000-memory.dmp Nirsoft behavioral1/memory/824-77-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/824-76-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/824-80-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/824-82-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
Loads dropped DLL 1 IoCs
Processes:
864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exepid process 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exedescription pid process target process PID 1188 set thread context of 428 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 428 set thread context of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exepid process 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exedescription pid process Token: SeDebugPrivilege 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe Token: SeDebugPrivilege 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exepid process 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.execmd.exe864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exedescription pid process target process PID 1188 wrote to memory of 1696 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe cmd.exe PID 1188 wrote to memory of 1696 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe cmd.exe PID 1188 wrote to memory of 1696 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe cmd.exe PID 1188 wrote to memory of 1696 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe cmd.exe PID 1696 wrote to memory of 988 1696 cmd.exe reg.exe PID 1696 wrote to memory of 988 1696 cmd.exe reg.exe PID 1696 wrote to memory of 988 1696 cmd.exe reg.exe PID 1696 wrote to memory of 988 1696 cmd.exe reg.exe PID 1188 wrote to memory of 1444 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 1444 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 1444 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 1444 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 428 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 428 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 428 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 428 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 428 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 428 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 428 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 428 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 1188 wrote to memory of 428 1188 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe PID 428 wrote to memory of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe PID 428 wrote to memory of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe PID 428 wrote to memory of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe PID 428 wrote to memory of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe PID 428 wrote to memory of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe PID 428 wrote to memory of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe PID 428 wrote to memory of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe PID 428 wrote to memory of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe PID 428 wrote to memory of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe PID 428 wrote to memory of 824 428 864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe"C:\Users\Admin\AppData\Local\Temp\864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\PcHealth\PcHealth.exe,explorer.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\PcHealth\PcHealth.exe,explorer.exe"3⤵
- Modifies WinLogon for persistence
-
C:\Users\Admin\AppData\Local\Temp\864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe"C:\Users\Admin\AppData\Local\Temp\864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe"C:\Users\Admin\AppData\Local\Temp\864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\PcHealth\PcHealth.exeFilesize
524KB
MD506cc29e1aa42737cc69ae959c8780f90
SHA15b0b8056b0b3a53ab31160131f7df0126821a4a0
SHA256864c60986b6f51d4dc811b9b897865705d1db27e6299fd00d5ce822b4b02d9f8
SHA5129dee67aab7c2c928cc1fe0353861d38dca1071a4163203bbea23c7e42057de768e685c05a7fd3a64a2f91c9d071c2d96713750f54c11c44b708d038da4757ae7
-
memory/428-74-0x0000000074200000-0x00000000747AB000-memory.dmpFilesize
5.7MB
-
memory/428-75-0x0000000074200000-0x00000000747AB000-memory.dmpFilesize
5.7MB
-
memory/428-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/428-71-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/428-69-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/428-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/428-61-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/428-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/428-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/428-67-0x0000000000485ABE-mapping.dmp
-
memory/428-81-0x00000000023A5000-0x00000000023B6000-memory.dmpFilesize
68KB
-
memory/824-77-0x0000000000411654-mapping.dmp
-
memory/824-76-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/824-80-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/824-82-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/988-59-0x0000000000000000-mapping.dmp
-
memory/1188-73-0x0000000074200000-0x00000000747AB000-memory.dmpFilesize
5.7MB
-
memory/1188-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/1188-56-0x0000000074200000-0x00000000747AB000-memory.dmpFilesize
5.7MB
-
memory/1188-55-0x0000000074200000-0x00000000747AB000-memory.dmpFilesize
5.7MB
-
memory/1696-58-0x0000000000000000-mapping.dmp