Analysis
-
max time kernel
149s -
max time network
105s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
04-12-2022 10:56
General
-
Target
27d85a395aef2dbd3bd3406a96651a4602483ab1a0cf8c95def0007742ccb754.exe
-
Size
287KB
-
MD5
043561f1837fae197aea41280e0e6350
-
SHA1
04db1bbf34a8ba926e430de6f447066707b66fd8
-
SHA256
27d85a395aef2dbd3bd3406a96651a4602483ab1a0cf8c95def0007742ccb754
-
SHA512
2cbc2eb024869eb6e636ffd5eed0f2dc7259c0adaef1e56862d52040d6723764dc24b3d10d1aa8d4ae7fb7d4eb4bd6d0a19fc790dadd3d43c9293500833e5913
-
SSDEEP
6144:HYdTOd+1ig3XO+UVLJrhwQns3879dj1Ur8RoD3tKXw:HYdKd+1RgVLxdj1UwRhXw
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27d85a395aef2dbd3bd3406a96651a4602483ab1a0cf8c95def0007742ccb754.exe"C:\Users\Admin\AppData\Local\Temp\27d85a395aef2dbd3bd3406a96651a4602483ab1a0cf8c95def0007742ccb754.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\27d85a395aef2dbd3bd3406a96651a4602483ab1a0cf8c95def0007742ccb754.exeC:\Users\Admin\AppData\Local\Temp\27d85a395aef2dbd3bd3406a96651a4602483ab1a0cf8c95def0007742ccb754.exe startC:\Users\Admin\AppData\Roaming\6D5B1\F9F45.exe%C:\Users\Admin\AppData\Roaming\6D5B12⤵
-
-
C:\Program Files (x86)\LP\45D6\EA12.tmp"C:\Program Files (x86)\LP\45D6\EA12.tmp"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\27d85a395aef2dbd3bd3406a96651a4602483ab1a0cf8c95def0007742ccb754.exeC:\Users\Admin\AppData\Local\Temp\27d85a395aef2dbd3bd3406a96651a4602483ab1a0cf8c95def0007742ccb754.exe startC:\Program Files (x86)\B1A96\lvvm.exe%C:\Program Files (x86)\B1A962⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x58c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD5a41925371a3d19c41fb25641d0a0df50
SHA1ecd36f0614698521ecf39eebca91ef139539b1fb
SHA25600c2f913943948ed58458208f38fbd64c86b3e82e62f9f09bf01507d6edb1a29
SHA51223d2ec4ea266612026b5ef629e672dd0a3991e144d420ced8aea23d028727fdd040f6fb14667098053b598ed34469f211ac855d8aac961cd771369aad12ba8e8
-
Filesize
102KB
MD5a41925371a3d19c41fb25641d0a0df50
SHA1ecd36f0614698521ecf39eebca91ef139539b1fb
SHA25600c2f913943948ed58458208f38fbd64c86b3e82e62f9f09bf01507d6edb1a29
SHA51223d2ec4ea266612026b5ef629e672dd0a3991e144d420ced8aea23d028727fdd040f6fb14667098053b598ed34469f211ac855d8aac961cd771369aad12ba8e8
-
Filesize
102KB
MD5a41925371a3d19c41fb25641d0a0df50
SHA1ecd36f0614698521ecf39eebca91ef139539b1fb
SHA25600c2f913943948ed58458208f38fbd64c86b3e82e62f9f09bf01507d6edb1a29
SHA51223d2ec4ea266612026b5ef629e672dd0a3991e144d420ced8aea23d028727fdd040f6fb14667098053b598ed34469f211ac855d8aac961cd771369aad12ba8e8
-
Filesize
116KB
-
Filesize
1024KB
-
Filesize
116KB
-
-
Filesize
8KB
-
Filesize
432KB
-
Filesize
8KB
-
Filesize
288KB
-
Filesize
432KB
-
Filesize
288KB
-
Filesize
288KB
-
-
Filesize
432KB
-
Filesize
288KB
-
Filesize
288KB
-
-
Filesize
288KB
-
Filesize
432KB
-
Filesize
288KB