038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0

General

Target

038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Size

3.3MB
MD5

8dba37604bf06ebcef07dd1085865a6a
SHA1

1202eb0ea461c502daa7da9d7d75fff226bf57bd
SHA256

038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0
SHA512

0f286677e964d733ea3270f0f196769d8ddddb4a6bb3007187eae56e9abb5e22ee984703df5356b5d9049e5ad3b24c567ae13773684113a4440b2cce5d0132fa
SSDEEP

49152:sJVKh1VrdmC/1xpLzgYSHx4yzj8zow4ylvrFgn/y5q2DiAtGJqT5+GP:rFdzgYSHx4yzj8zowFdyotWA

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe"	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.DocHostUIHandler	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe \"%1\""	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.DocHostUIHandler"	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile\ShellNew	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\EditFlags = "0"	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\ = "mprf"	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe,0"	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.DocHostUIHandler\Clsid	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\BrowserFlags = "8"	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.DocHostUIHandler\ = "Implements DocHostUIHandler"	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2000	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
2000	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2000	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
2000	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe

C:\Users\Admin\AppData\Local\Temp\038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe
"C:\Users\Admin\AppData\Local\Temp\038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0.exe"
1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_win_path
PID:2000