ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f

General

Target

ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Size

883KB
MD5

82a04987881920d9871e0c70b5646941
SHA1

38c09a02cc08150180bab88e7d3323fc3d85d412
SHA256

ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f
SHA512

8cde8ab68ef8067630aff0266f9d075d596a0a022fdad6a5c815e36f6f45cbb1a9c0bfd8144bccaacf1d487ecc2f3c6cf11168ec0ecf35c054bd470d0b8f30ea
SSDEEP

12288:UV8WW9dHvfBBdjL8dmMlvHruaQvQYfuzUphteQanVFbm9fwrMdrj1Wxygr9JuBtd:o8WWLftj6m83nzMvb6YdCZolQZEPQ2

Score

8^/10

collection discovery spyware stealer upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1700-55-0x0000000000500000-0x000000000077C000-memory.dmp	upx
behavioral1/memory/1700-57-0x0000000000500000-0x000000000077C000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies registry class 24 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe"	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.DocHostUIHandler\ = "Implements DocHostUIHandler"	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile\ShellNew	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.DocHostUIHandler	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.DocHostUIHandler\Clsid	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\ = "mprf"	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\BrowserFlags = "8"	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\EditFlags = "0"	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe,0"	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe \"%1\""	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.DocHostUIHandler"	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1700	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
1700	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1700	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
1700	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe

C:\Users\Admin\AppData\Local\Temp\ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe
"C:\Users\Admin\AppData\Local\Temp\ad454d678d4d455fea7da8a23c49ba17253798b07d6458fc8579a5e6fe3e2b0f.exe"
1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_win_path
PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1700-55-0x0000000000500000-0x000000000077C000-memory.dmp

Filesize
2.5MB

Download
memory/1700-57-0x0000000000500000-0x000000000077C000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads