d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435

General

Target

d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe
Size

481KB
MD5

c48f179e0015278c3e1c35c23918e395
SHA1

20f47f3051d785604692115c92715d6edbafa47b
SHA256

d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435
SHA512

de8dc3dac71eb06134cc21bca8effdbd915fb0fbdbb404311a180498c453e53daf02a19b0c4d6953e31932a446b9212c7f85c6794e9aff8ec56e8819539db393
SSDEEP

12288:DDNkFa5fF7RTX979xwJyTW7DsVpCSmGiHyJC+S8h:DJ+gF1tTyyTW7Cp13C0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4544	pcrypted.exe
3232	brute.exe
3316	pcrypted.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	pcrypted.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4272 set thread context of 2772	4272	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	80
PID 4544 set thread context of 3316	4544	pcrypted.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4328	4544	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3316	pcrypted.exe
3316	pcrypted.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3316	pcrypted.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3232	brute.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3232	brute.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2772	4272	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	80
PID 4272 wrote to memory of 2772	4272	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	80
PID 4272 wrote to memory of 2772	4272	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	80
PID 4272 wrote to memory of 2772	4272	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	80
PID 4272 wrote to memory of 2772	4272	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	80
PID 2772 wrote to memory of 4544	2772	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	81
PID 2772 wrote to memory of 4544	2772	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	81
PID 2772 wrote to memory of 4544	2772	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	81
PID 2772 wrote to memory of 3232	2772	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	82
PID 2772 wrote to memory of 3232	2772	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	82
PID 2772 wrote to memory of 3232	2772	d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe	82
PID 4544 wrote to memory of 3316	4544	pcrypted.exe	83
PID 4544 wrote to memory of 3316	4544	pcrypted.exe	83
PID 4544 wrote to memory of 3316	4544	pcrypted.exe	83
PID 4544 wrote to memory of 3316	4544	pcrypted.exe	83
PID 4544 wrote to memory of 3316	4544	pcrypted.exe	83

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	pcrypted.exe

C:\Users\Admin\AppData\Local\Temp\d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe
"C:\Users\Admin\AppData\Local\Temp\d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Local\Temp\d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe
  C:\Users\Admin\AppData\Local\Temp\d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\pcrypted.exe
    "C:\Users\Admin\AppData\Local\Temp\pcrypted.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\pcrypted.exe
      C:\Users\Admin\AppData\Local\Temp\pcrypted.exe
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_win_path
      PID:3316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 284
      4⤵
      Program crash
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\brute.exe
    "C:\Users\Admin\AppData\Local\Temp\brute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4544 -ip 4544
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4544 -ip 4544
1⤵
PID:740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\brute.exe

Filesize
38KB

MD5
1db91636706ae1b96dcfd4f6da627513

SHA1
cc906db45a067ba906ee3f0bfe9037758f2b925a

SHA256
4f9d7e8a79396191bd55cf48323038a1fcc486aa1ae32b8f2cc0ed54a3452208

SHA512
f515498b48c320f7da7902f9c3c641813c028a3423f688353249de62da03df57bcbdc3189d1cbbf9257acc34574bc534a1010403c4edbe0df26835b39ac53a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\brute.exe

Filesize
38KB

MD5
1db91636706ae1b96dcfd4f6da627513

SHA1
cc906db45a067ba906ee3f0bfe9037758f2b925a

SHA256
4f9d7e8a79396191bd55cf48323038a1fcc486aa1ae32b8f2cc0ed54a3452208

SHA512
f515498b48c320f7da7902f9c3c641813c028a3423f688353249de62da03df57bcbdc3189d1cbbf9257acc34574bc534a1010403c4edbe0df26835b39ac53a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcrypted.exe

Filesize
73KB

MD5
bdbf620bc6b82316af1beb51d9596f9a

SHA1
58a41d2205991d093003eaa7dba6e1cf4553ac77

SHA256
100536f36c32d1392cfa18490cad9f490a2021c61c88cd65d14b2ceeed22be6c

SHA512
3b71c0023cf49b6846410598ef5f338008ed9d433031612026fa4221af1763d70e94a2e5a6c5caa60ef60ff632b602a967e2148d17682d6ab0336dd7a615d0de

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcrypted.exe

Filesize
73KB

MD5
bdbf620bc6b82316af1beb51d9596f9a

SHA1
58a41d2205991d093003eaa7dba6e1cf4553ac77

SHA256
100536f36c32d1392cfa18490cad9f490a2021c61c88cd65d14b2ceeed22be6c

SHA512
3b71c0023cf49b6846410598ef5f338008ed9d433031612026fa4221af1763d70e94a2e5a6c5caa60ef60ff632b602a967e2148d17682d6ab0336dd7a615d0de

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcrypted.exe

Filesize
73KB

MD5
bdbf620bc6b82316af1beb51d9596f9a

SHA1
58a41d2205991d093003eaa7dba6e1cf4553ac77

SHA256
100536f36c32d1392cfa18490cad9f490a2021c61c88cd65d14b2ceeed22be6c

SHA512
3b71c0023cf49b6846410598ef5f338008ed9d433031612026fa4221af1763d70e94a2e5a6c5caa60ef60ff632b602a967e2148d17682d6ab0336dd7a615d0de

Download Submit
memory/2772-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2772-133-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2772-145-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3316-143-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/3316-147-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/3316-149-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/3316-150-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3316-152-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/4544-141-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4544-151-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing