Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26/12/2022, 10:20
General
-
Target
88dde4d981cff40f7df3f21b095e8714ae6805e34db8fcc5e4de3e6ed3348970.exe
-
Size
1022KB
-
MD5
8e1fa9f186fde8e12741505d3a4bc629
-
SHA1
230996e3245dfa7a3352a1003defee1f096bf889
-
SHA256
88dde4d981cff40f7df3f21b095e8714ae6805e34db8fcc5e4de3e6ed3348970
-
SHA512
42762e72cdd4e694468166df618d82a9cc7212382b7718291142b3d6dc394faceb881287a7a0fe0aeeeb6972f611f47a627eee7b938df2086838ede740a9b423
-
SSDEEP
24576:qYwPrOk3w1f0CxRWo+hQcGv9t4Cke4QZAzFoV6Ui:7wPrOGwF0cgojHvD4c4QZSW
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 49 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88dde4d981cff40f7df3f21b095e8714ae6805e34db8fcc5e4de3e6ed3348970.exe"C:\Users\Admin\AppData\Local\Temp\88dde4d981cff40f7df3f21b095e8714ae6805e34db8fcc5e4de3e6ed3348970.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp",Dioeeedresq2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 140053⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 5282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2148 -ip 21481⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\google\temp\stop_collection_data.dll",ZlEVRG01dW4=2⤵
- Loads dropped DLL
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
792KB
MD54fb5757d0091022735221f9e0db262d8
SHA16ba9817d50b0e3066728aa054a3d28d8df257e13
SHA256d0395f67702ee218dd060094f36d3b5566115314023ec952fa506572fbbb3e96
SHA5122cf7b9e45509a25d38bda4ecc9ee224f4f23b2e3ee5919ac8923b982012f7a0e236494730cc7d397762d6686f8722e9fe0dc8c9fcadd6768645352b2a9c8d486
-
Filesize
792KB
MD54fb5757d0091022735221f9e0db262d8
SHA16ba9817d50b0e3066728aa054a3d28d8df257e13
SHA256d0395f67702ee218dd060094f36d3b5566115314023ec952fa506572fbbb3e96
SHA5122cf7b9e45509a25d38bda4ecc9ee224f4f23b2e3ee5919ac8923b982012f7a0e236494730cc7d397762d6686f8722e9fe0dc8c9fcadd6768645352b2a9c8d486
-
Filesize
10KB
MD5220ae72aa2505c9276da2056b7e34936
SHA16dfb0f4fd5c0d25062d3d1235fc20358560fdb89
SHA256afc37ba57fac36ba151953b67619dbbb985f58122f4ebe07f15b312b5bdf004c
SHA512cab8485458b9870015f037fc6c8279018bf212d36ba01181bdb90970473a4b5aaeb9708e36eb21c8e6c1301dbdca630b29c8b3a6fa82fa14fb04bc65d235debd
-
Filesize
1KB
MD53793544370ec1fddcf5ba6ae099f2538
SHA1c784c5d8d1c496ab7ba1150782d20cba67b76321
SHA25687975551187040cc2505a12ac285c042b8e70921a55808ecf982c7cd37df0ae2
SHA512debdde56e6e087ff04863490223229d37828e348f7630d6c33aae1f113cce4be75f1420c593268ef5f5bd3026dccb062015781ba83dcaffa2b9bb37b55efc319
-
Filesize
3.5MB
MD51e9a5efecd8ad1d41b4f58046f71d3d5
SHA110d41172bb9d9879fc33e5f0d9beb47636dcf289
SHA2563bc250c43a9e76b8e909f70606cd24ecfeb1780987408338c3a366cd268f8be5
SHA5120fdef9e5e107bff5233d79300623230a3810acbaad904756ab6966c47c2970c36596c26933eea6de39ec1f952d70dbc12da42702ec5bcdf006b6609f1c0fd685
-
Filesize
29KB
MD50edf0ff4a8a9986d080992dd07e8a177
SHA1bd58bb41baf5418a8ffaa8f75fb8fe412cf012a8
SHA2567117f778c590d79b5a434edaa09448f23332d1db26676db2c9463b0d2c2ddfb6
SHA512faa4c4fe982301ba2f5f2e239889c964bdb9f70b3939516e480987067a2b6482f6803bc06a514e6aac407be1306534b216dc2a801027722e985d1a2f41c01704
-
Filesize
26KB
MD526b4cb86e7313855e188214dfee0abe4
SHA1c4488e4c3c91bb6bd49cc3e68d9fce83c59f8422
SHA256d182821a1030c629318d6e379cba49ac00db7a2b6aab70a3d245f7418ef490bc
SHA51278dd7247c0fd372bc146562f46dd453aaa9fc3e4a49fb669240f76bd90249534bf6ca660058bf854eb4c05170a2e2ddabc0813223b61f09f0673fb3939f6f2b1
-
Filesize
90KB
MD54a3dfa97bca6afab1b03b3338e1080fb
SHA13ec3a3d5eaa9c184ecd8b5ecc206e67c5ecb77b8
SHA2564a34ab4c457ba5652c5b2f99ae5b35ed830c1cb35082f2cd48fcfd9ec5d5cf93
SHA512df80dc86c5ea63dc1ae448d6a8d6933b835243ed014c46a21f676b072bbe73d6f4f5ff3d3d5edbdb8b04d27473a2bbb110d6be43c2f2e6c7e5e339a838e0a8ee
-
Filesize
10B
MD5bea59a2f25178d677087edde21c60be7
SHA156844a00adee7f8d2c161808de19ce6fd191fb61
SHA2564906553c99e9225413bacd029603f2549fe8d972bf389770063f3e932b623d80
SHA512008622e6bf66c3cc4bdfc9cda7dc10376e310b560321ee0d7040f7c6da7673cd04799ee04b9e22bb45de378fa0791dc0b6bbf43efed1366d0520c26d803d7400
-
Filesize
1KB
MD59e3d2d6830eba41e31e8558da30ddccd
SHA1f5fbe0dfef87a30a9898cd6e1e7691c7dd9a9b99
SHA25650ce5d2f9497955246143e7bb7d7584f221c15574a910c7cc11af87537711d25
SHA512d1f3774e8c2bdfb6acbb8b9429f59fce5048b5adc4ddc7ecacf7bf52862715db35aee04884a24a8e329e8d10aa5fd06cac5360aad9dd296582453fadadf4d7ee
-
Filesize
38KB
MD545b3b7ada6575d1623bd52d029d7cf96
SHA1ae4810a660e18d7e40594d1e8e0fe33b46a7f2a4
SHA2560f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
SHA512c7d39db201687940bcbf8e3afb90becf5389640d7948e0cf3518bfae98fda1496650fa59a490631fcad894a9aa0f3d78e4d8b5bb9df57812abbc010c638926a8
-
Filesize
10KB
MD5c949974e2fc5c8909c2efafb92f7640d
SHA1ec68489a4a4fa022e5b60901f7221d733365a9c9
SHA2561131721b6f906cedebbcefe223725ae0f5c7ad0a96219eabaa49dc8d38cedf40
SHA5128fc8e3cdcb66ec98962d0f888f0abe90e1a18db09144e00494dda9f56eaf7ed623e0ee13efd8a29fbf72c7094bbc9f489baf2d54e8170bb4b04d5363ec354362
-
Filesize
28B
MD56c7e84cb1a40e1e6a5cfe37e2ceaad04
SHA1a2781444bb3c55196292df729b01be707ec1953a
SHA256c6bf69533d3fc2c00d2e601726411163cae0e6cb168662eb6a58b492a25b042c
SHA51297c9bc007beda6e6ea9c9aeea3f4033fe77304d5417a9f9f97ede9ed168f7259053f5861227a3a7eaa4859d1d1a7898705b0f8aae9527b4b607ab205e3b6e9aa
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD54fb5757d0091022735221f9e0db262d8
SHA16ba9817d50b0e3066728aa054a3d28d8df257e13
SHA256d0395f67702ee218dd060094f36d3b5566115314023ec952fa506572fbbb3e96
SHA5122cf7b9e45509a25d38bda4ecc9ee224f4f23b2e3ee5919ac8923b982012f7a0e236494730cc7d397762d6686f8722e9fe0dc8c9fcadd6768645352b2a9c8d486
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.7MB
-
Filesize
2.6MB
-
Filesize
2.7MB
-
Filesize
856KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
1.2MB
