Analysis
-
max time kernel
63s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 18:14
Static task
static1
Behavioral task
behavioral1
Sample
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe
Resource
win10v2004-20220901-en
General
-
Target
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe
-
Size
2.0MB
-
MD5
97be38c59938ec4fa566da5c776fea87
-
SHA1
1f1c02b4134c757656062b8718ed9a91fc5db7db
-
SHA256
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b
-
SHA512
06f82bba386c838e88a1e9c2585f92a4f939565cd1f380b7ae16e0fd7426999639d0fd517a9ad0a6d759a659d7e2b30a957c5159e871034c0fa1bcaf044fe126
-
SSDEEP
49152:sMMMMMMMMMMMMMMMMMMMMMMMM9MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM3:sMMMMMMMMMMMMMMMMMMMMMMMM9MMMMM3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
hunojj.exepid process 1788 hunojj.exe -
Loads dropped DLL 4 IoCs
Processes:
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exepid process 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
hunojj.exeRegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\LD9A66~1 = "C:\\Users\\Admin\\LD9A66~1\\vkazj.vbs" hunojj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" RegSvcs.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce hunojj.exe -
Processes:
hunojj.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hunojj.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 whatismyipaddress.com 5 whatismyipaddress.com 6 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
hunojj.exeRegSvcs.exedescription pid process target process PID 1788 set thread context of 860 1788 hunojj.exe RegSvcs.exe PID 860 set thread context of 1968 860 RegSvcs.exe vbc.exe PID 860 set thread context of 1624 860 RegSvcs.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
hunojj.exeRegSvcs.exepid process 1788 hunojj.exe 1788 hunojj.exe 860 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
hunojj.exevbc.exevbc.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1788 hunojj.exe Token: SeDebugPrivilege 1968 vbc.exe Token: SeDebugPrivilege 1624 vbc.exe Token: SeDebugPrivilege 860 RegSvcs.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exehunojj.exeRegSvcs.exedescription pid process target process PID 1224 wrote to memory of 1788 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe hunojj.exe PID 1224 wrote to memory of 1788 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe hunojj.exe PID 1224 wrote to memory of 1788 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe hunojj.exe PID 1224 wrote to memory of 1788 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe hunojj.exe PID 1224 wrote to memory of 1788 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe hunojj.exe PID 1224 wrote to memory of 1788 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe hunojj.exe PID 1224 wrote to memory of 1788 1224 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe hunojj.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 1788 wrote to memory of 860 1788 hunojj.exe RegSvcs.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1968 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe PID 860 wrote to memory of 1624 860 RegSvcs.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe"C:\Users\Admin\AppData\Local\Temp\c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\ld9a668r1gtnm9s\hunojj.exe"C:\Users\Admin\ld9a668r1gtnm9s\hunojj.exe" xnzf2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"4⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holdermail.txtFilesize
400B
MD5de4e5ff058882957cf8a3b5f839a031f
SHA10b3d8279120fb5fa27efbd9eee89695aa040fc24
SHA256ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49
SHA512a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72
-
C:\Users\Admin\AppData\Local\Temp\holdermail.txtFilesize
329B
MD5f8ddf0fe04f214d64c3e5094ed622858
SHA1245a91a1c968c45820fbbb319c1bcfc98b01b04e
SHA256f73d76c930aa76b78390a50ee72b9169c7064b9e1256de76ab9ffb43bca8f5d3
SHA512e6385a3d47f8969f2079ae28a4e2753c2da60e37601ebd15049e21f1490e7a1ec760a3cc6c8b75a8049aa8a08735a9f24187d7ad13c6ac8d4a5510dc88718900
-
C:\Users\Admin\LD9A66~1\OOBQPT~1.NLEFilesize
1.1MB
MD55978c5b2e00aac09777d510991bb0d08
SHA15966781692b068840f4f69ba43218944e49a30ca
SHA25638aa72aac1da6f4f98d920f64f3022935dadb5684157e6fbc5f7da1a4068b086
SHA5128ad3c55f8e1f39aa529a3a008d5f1abc8f9f500360a5265343f4a26c75a6d474a6fae207c95991e5e51845e4c1ae37e98eeb3e078f4cbe40559177f37af0c1b0
-
C:\Users\Admin\LD9A66~1\nhnagqp.NDNFilesize
64B
MD538d6a6d36267d2ea20ee5e96af5192c6
SHA17cdb980fafd96a2146a37aa24c618f5ea44d4ee5
SHA25683d7497ace57ecaa27c558dd433ec268cf1b45a05cdfa178d8cce664a4b6ac43
SHA5120bf6454e029e45a6cc442948a0ee76d6f49f5705ae4545393331350b22d34d38aeb7256a11b6fcc828ed309719dd64ee68daf1932150cea21a008a4a90e92863
-
C:\Users\Admin\ld9a668r1gtnm9s\hunojj.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\ld9a668r1gtnm9s\xnzfFilesize
218.9MB
MD56f5ca0ec3ae15ef58e1e1c57af731ec4
SHA130e9c7524a2c2230f5f55df78fb35dbf42bcfd8c
SHA256d6f1cd03728b91d4e38809863aa75ca98be87d6835c071da62430bc5f9ca07ca
SHA512df2ff289466985d8d2b0121e971a770017caeb870ef7657fbeb4ddaa38488f4c2059f069e8725723d869d73c3ae03329778c1551d3808f08218c20df98774f5f
-
\Users\Admin\ld9a668r1gtnm9s\hunojj.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\ld9a668r1gtnm9s\hunojj.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\ld9a668r1gtnm9s\hunojj.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\ld9a668r1gtnm9s\hunojj.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
memory/860-65-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/860-66-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/860-70-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/860-71-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/860-68-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/860-72-0x000000000051BB1E-mapping.dmp
-
memory/860-74-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/860-76-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/860-78-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/860-79-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/860-80-0x0000000000255000-0x0000000000266000-memory.dmpFilesize
68KB
-
memory/860-115-0x0000000000255000-0x0000000000266000-memory.dmpFilesize
68KB
-
memory/1224-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmpFilesize
8KB
-
memory/1624-99-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1624-110-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1624-114-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1624-112-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1624-107-0x0000000000460E2D-mapping.dmp
-
memory/1624-106-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1624-105-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1624-101-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1624-103-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1624-98-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1788-59-0x0000000000000000-mapping.dmp
-
memory/1968-86-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1968-97-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1968-89-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1968-95-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1968-93-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1968-81-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1968-88-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1968-84-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1968-82-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1968-90-0x0000000000462B6D-mapping.dmp