Analysis
-
max time kernel
155s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 18:17
Static task
static1
Behavioral task
behavioral1
Sample
8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exe
Resource
win10v2004-20220812-en
General
-
Target
8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exe
-
Size
1.6MB
-
MD5
0f1324a444ff146cc0f30287fc9e23ab
-
SHA1
76717c29d5f3eb293109e0a308f78f2c9703e96c
-
SHA256
8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c
-
SHA512
3526e2a12685a2a8c7cca3c0bea8f13b28268ad953cb0c02be8aaa270d7980db6fb5c6bc054496f52e78cb3184904e88ad5ea07172937af7e138d2bec0fc0a4e
-
SSDEEP
49152:QBoyP2xcL4jJEtOiKjyUkUA5kFm53Sypn:OoyP2xcUWtcjtkx5kFm5dn
Malware Config
Signatures
-
NirSoft MailPassView 6 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3556-138-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/3556-139-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral2/memory/2496-143-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/2496-142-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/2496-145-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/2496-146-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 7 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3556-138-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/3556-139-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral2/memory/4340-148-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/4340-147-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/4340-150-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/4340-151-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/4340-153-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView -
Nirsoft 19 IoCs
Processes:
resource yara_rule behavioral2/memory/3556-138-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/3556-139-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral2/memory/2496-143-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/2496-142-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/2496-145-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/2496-146-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4340-148-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/4340-147-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4340-150-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/4340-151-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/4340-153-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/4652-154-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4652-155-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/4652-157-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/4652-159-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/1484-160-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/1484-161-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft behavioral2/memory/1484-163-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft behavioral2/memory/1484-164-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft -
Executes dropped EXE 1 IoCs
Processes:
acrob32.exepid process 3448 acrob32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
acrob32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce acrob32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\9Y8W1V~1 = "C:\\Users\\Admin\\9Y8W1V~1\\stxluizcmekwx.vbs" acrob32.exe -
Processes:
acrob32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA acrob32.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 32 whatismyipaddress.com 34 whatismyipaddress.com -
Suspicious use of SetThreadContext 5 IoCs
Processes:
acrob32.exeRegSvcs.exedescription pid process target process PID 3448 set thread context of 3556 3448 acrob32.exe RegSvcs.exe PID 3556 set thread context of 2496 3556 RegSvcs.exe vbc.exe PID 3556 set thread context of 4340 3556 RegSvcs.exe vbc.exe PID 3556 set thread context of 4652 3556 RegSvcs.exe vbc.exe PID 3556 set thread context of 1484 3556 RegSvcs.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
acrob32.exeRegSvcs.exepid process 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3448 acrob32.exe 3556 RegSvcs.exe 3448 acrob32.exe 3448 acrob32.exe 3556 RegSvcs.exe 3556 RegSvcs.exe 3448 acrob32.exe 3448 acrob32.exe 3556 RegSvcs.exe 3556 RegSvcs.exe 3448 acrob32.exe 3448 acrob32.exe 3556 RegSvcs.exe 3556 RegSvcs.exe 3556 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3556 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 3556 RegSvcs.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exeacrob32.exeRegSvcs.exedescription pid process target process PID 4072 wrote to memory of 3448 4072 8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exe acrob32.exe PID 4072 wrote to memory of 3448 4072 8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exe acrob32.exe PID 4072 wrote to memory of 3448 4072 8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exe acrob32.exe PID 3448 wrote to memory of 3556 3448 acrob32.exe RegSvcs.exe PID 3448 wrote to memory of 3556 3448 acrob32.exe RegSvcs.exe PID 3448 wrote to memory of 3556 3448 acrob32.exe RegSvcs.exe PID 3448 wrote to memory of 3556 3448 acrob32.exe RegSvcs.exe PID 3448 wrote to memory of 3556 3448 acrob32.exe RegSvcs.exe PID 3448 wrote to memory of 3556 3448 acrob32.exe RegSvcs.exe PID 3448 wrote to memory of 3556 3448 acrob32.exe RegSvcs.exe PID 3448 wrote to memory of 3556 3448 acrob32.exe RegSvcs.exe PID 3556 wrote to memory of 2496 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 2496 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 2496 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 2496 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 2496 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 2496 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 2496 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 2496 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 2496 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4340 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4340 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4340 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4340 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4340 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4340 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4340 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4340 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4340 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4652 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4652 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4652 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4652 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4652 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4652 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4652 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4652 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 4652 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 1484 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 1484 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 1484 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 1484 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 1484 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 1484 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 1484 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 1484 3556 RegSvcs.exe vbc.exe PID 3556 wrote to memory of 1484 3556 RegSvcs.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exe"C:\Users\Admin\AppData\Local\Temp\8245f69f7c8a141f49a600d2e9fc6b106d44057279a1695f817d3fd51eccd17c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\9y8w1ve2gd2wo\acrob32.exe"C:\Users\Admin\9y8w1ve2gd2wo\acrob32.exe" hbfmkztff2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"4⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderprodkey.txt"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderskypeview.txt"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\9Y8W1V~1\rfhapkck.BXOFilesize
90B
MD58bfd1d97f7ea0a5a6add56983f1ccce5
SHA123a501e175e1ee904bf52e87d4234bbbb0d085d6
SHA25660a5c8150e9c5772e16bf522a73b53e729fa50ce61883af70b1e5b85e1b27fb9
SHA512de642e70c802776e77eed2306fc447d0586b7cfdefb336d997ed20d7040bc6f39087280870043dbe41682fc69a8a127b542024ccdb8fa71e1a7ce81129c38fdc
-
C:\Users\Admin\9Y8W1V~1\xfzdz.VHAFilesize
936KB
MD5da328370c2c8a4659e436bfe5a6d03e4
SHA199b9a5780514c049f55611939424e4addd15e924
SHA2566426bb51efb718c35d6d7682a61c4f11db44ef5c7b8b9c41c730e2e614b67339
SHA512a058ec4fee0090ef2ba36973802a2102603d4216cd6cad7e7e4889d507f69ac78cb38fee35c344414e11cf7afca942df5ff5bf922a44b33bb2b413c6efee3faa
-
C:\Users\Admin\9y8w1ve2gd2wo\acrob32.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\9y8w1ve2gd2wo\acrob32.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\9y8w1ve2gd2wo\hbfmkztffFilesize
306.2MB
MD5e6d7186df8d62403b92f9c26da0c3a4b
SHA18632b4b89780b1c1c4bf4b91086abe143e5f8c2f
SHA256601c4a2f50cce4919cfc6881d0639b00482491c17fdf79d5d2c7b9def4aa6faf
SHA512c42e105fb0ffc2484c07d8deefb2df2bea0d7807627e528d7709d134bcacc3ff3350cc7ab4d5e513972680143e9bbc9500d3d1b734d7d53024ab9b33d1c7491b
-
C:\Users\Admin\AppData\Local\Temp\holderprodkey.txtFilesize
725B
MD568a27438ef306b0b71bb620481d50b8d
SHA18243ae08f3b62623704e1e7a768dbb665a1f6176
SHA2568282d20570a3b80b776b065425fba26508b6b0a1e4ad7af929b0f03a8c597bb1
SHA5126a3edfe3d0dd262ced79ba893f7b3372df1b644f9d11083fcd5d36aaa1abb64f7dc64535c38e9f3a0c5ad931d0b4b05054b9158e0f969cf634b3e7dbe85415fc
-
C:\Users\Admin\AppData\Local\Temp\holderskypeview.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
memory/1484-164-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1484-163-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1484-161-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1484-160-0x0000000000000000-mapping.dmp
-
memory/2496-143-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2496-142-0x0000000000000000-mapping.dmp
-
memory/2496-145-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2496-146-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3448-132-0x0000000000000000-mapping.dmp
-
memory/3556-141-0x00000000744E0000-0x0000000074A91000-memory.dmpFilesize
5.7MB
-
memory/3556-140-0x00000000744E0000-0x0000000074A91000-memory.dmpFilesize
5.7MB
-
memory/3556-139-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/3556-138-0x0000000000000000-mapping.dmp
-
memory/4340-148-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4340-153-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4340-151-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4340-150-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4340-147-0x0000000000000000-mapping.dmp
-
memory/4652-157-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/4652-159-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/4652-155-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/4652-154-0x0000000000000000-mapping.dmp