Analysis
-
max time kernel
144s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 18:14
Static task
static1
Behavioral task
behavioral1
Sample
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe
Resource
win10v2004-20220901-en
General
-
Target
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe
-
Size
2.0MB
-
MD5
97be38c59938ec4fa566da5c776fea87
-
SHA1
1f1c02b4134c757656062b8718ed9a91fc5db7db
-
SHA256
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b
-
SHA512
06f82bba386c838e88a1e9c2585f92a4f939565cd1f380b7ae16e0fd7426999639d0fd517a9ad0a6d759a659d7e2b30a957c5159e871034c0fa1bcaf044fe126
-
SSDEEP
49152:sMMMMMMMMMMMMMMMMMMMMMMMM9MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM3:sMMMMMMMMMMMMMMMMMMMMMMMM9MMMMM3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
hunojj.exepid process 1536 hunojj.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
hunojj.exeRegSvcs.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce hunojj.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\LD9A66~1 = "C:\\Users\\Admin\\LD9A66~1\\vkazj.vbs" hunojj.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" RegSvcs.exe -
Processes:
hunojj.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hunojj.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 whatismyipaddress.com 16 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
hunojj.exeRegSvcs.exedescription pid process target process PID 1536 set thread context of 1092 1536 hunojj.exe RegSvcs.exe PID 1092 set thread context of 3444 1092 RegSvcs.exe vbc.exe PID 1092 set thread context of 1772 1092 RegSvcs.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
hunojj.exeRegSvcs.exepid process 1536 hunojj.exe 1536 hunojj.exe 1536 hunojj.exe 1536 hunojj.exe 1092 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
hunojj.exeRegSvcs.exevbc.exevbc.exedescription pid process Token: SeDebugPrivilege 1536 hunojj.exe Token: SeDebugPrivilege 1092 RegSvcs.exe Token: SeDebugPrivilege 3444 vbc.exe Token: SeDebugPrivilege 1772 vbc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exehunojj.exeRegSvcs.exedescription pid process target process PID 4100 wrote to memory of 1536 4100 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe hunojj.exe PID 4100 wrote to memory of 1536 4100 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe hunojj.exe PID 4100 wrote to memory of 1536 4100 c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe hunojj.exe PID 1536 wrote to memory of 1092 1536 hunojj.exe RegSvcs.exe PID 1536 wrote to memory of 1092 1536 hunojj.exe RegSvcs.exe PID 1536 wrote to memory of 1092 1536 hunojj.exe RegSvcs.exe PID 1536 wrote to memory of 1092 1536 hunojj.exe RegSvcs.exe PID 1536 wrote to memory of 1092 1536 hunojj.exe RegSvcs.exe PID 1536 wrote to memory of 1092 1536 hunojj.exe RegSvcs.exe PID 1536 wrote to memory of 1092 1536 hunojj.exe RegSvcs.exe PID 1536 wrote to memory of 1092 1536 hunojj.exe RegSvcs.exe PID 1092 wrote to memory of 3444 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 3444 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 3444 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 3444 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 3444 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 3444 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 3444 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 3444 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 3444 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 1772 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 1772 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 1772 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 1772 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 1772 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 1772 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 1772 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 1772 1092 RegSvcs.exe vbc.exe PID 1092 wrote to memory of 1772 1092 RegSvcs.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe"C:\Users\Admin\AppData\Local\Temp\c7f8049e5f6fb12cae4118af2097f9337d32e0134866fb9f0f606e492b1b253b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\ld9a668r1gtnm9s\hunojj.exe"C:\Users\Admin\ld9a668r1gtnm9s\hunojj.exe" xnzf2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"4⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holdermail.txtFilesize
327B
MD51265c5140a2f68b05b92aa1a25a2abb6
SHA1627a660e9d2a41c8c4a662ca44fdb68a1356bc82
SHA256694bae0c1ebf6f8eeb8d902b1bfad57ed9a42dea6d3e327a0137a1c9f4f0c6b9
SHA512ad6a1dd57ec84459f28926d07e25f2c4f49dc67ff95b8400e85c3bcb8eccc471dbac5e2b1a2758fb563866ecacc2fae4657dfb85197fb4cd2547eef334b8a216
-
C:\Users\Admin\AppData\Local\Temp\holdermail.txtFilesize
1KB
MD501e7975c708365983265ae40d604beb4
SHA1f1c793c9b7a312d355cd944928ba9272bbeec44e
SHA25695d7aeb5f67dc33d0b62d02b26a5d469436f58f2246fd95189a8b86220bc9a40
SHA5129c67c306fbb0e191ea7af01388c6a99714c353590d99887ddd0b0ceee3f6cd3af2e7b2c8d1d22a5a34dac746e4b2156876d935a658afc9a1d38597fd4922e023
-
C:\Users\Admin\LD9A66~1\OOBQPT~1.NLEFilesize
1.1MB
MD55978c5b2e00aac09777d510991bb0d08
SHA15966781692b068840f4f69ba43218944e49a30ca
SHA25638aa72aac1da6f4f98d920f64f3022935dadb5684157e6fbc5f7da1a4068b086
SHA5128ad3c55f8e1f39aa529a3a008d5f1abc8f9f500360a5265343f4a26c75a6d474a6fae207c95991e5e51845e4c1ae37e98eeb3e078f4cbe40559177f37af0c1b0
-
C:\Users\Admin\LD9A66~1\nhnagqp.NDNFilesize
64B
MD538d6a6d36267d2ea20ee5e96af5192c6
SHA17cdb980fafd96a2146a37aa24c618f5ea44d4ee5
SHA25683d7497ace57ecaa27c558dd433ec268cf1b45a05cdfa178d8cce664a4b6ac43
SHA5120bf6454e029e45a6cc442948a0ee76d6f49f5705ae4545393331350b22d34d38aeb7256a11b6fcc828ed309719dd64ee68daf1932150cea21a008a4a90e92863
-
C:\Users\Admin\ld9a668r1gtnm9s\hunojj.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\ld9a668r1gtnm9s\hunojj.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\ld9a668r1gtnm9s\xnzfFilesize
218.9MB
MD56f5ca0ec3ae15ef58e1e1c57af731ec4
SHA130e9c7524a2c2230f5f55df78fb35dbf42bcfd8c
SHA256d6f1cd03728b91d4e38809863aa75ca98be87d6835c071da62430bc5f9ca07ca
SHA512df2ff289466985d8d2b0121e971a770017caeb870ef7657fbeb4ddaa38488f4c2059f069e8725723d869d73c3ae03329778c1551d3808f08218c20df98774f5f
-
memory/1092-147-0x0000000074E60000-0x0000000075411000-memory.dmpFilesize
5.7MB
-
memory/1092-139-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/1092-138-0x0000000000000000-mapping.dmp
-
memory/1092-140-0x0000000074E60000-0x0000000075411000-memory.dmpFilesize
5.7MB
-
memory/1536-132-0x0000000000000000-mapping.dmp
-
memory/1772-149-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1772-148-0x0000000000000000-mapping.dmp
-
memory/1772-150-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1772-151-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1772-152-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1772-154-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3444-146-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/3444-144-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/3444-143-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/3444-142-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/3444-141-0x0000000000000000-mapping.dmp