Analysis
-
max time kernel
368s -
max time network
375s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 10:39
Static task
static1
Behavioral task
behavioral1
Sample
Doc-102PO-207841001jpg.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Doc-102PO-207841001jpg.exe
Resource
win10v2004-20220812-en
General
-
Target
Doc-102PO-207841001jpg.exe
-
Size
2MB
-
MD5
0596aefc251ba32dcb538593b0616568
-
SHA1
9ceb68e35b93711e8247512c21ad2ccd6b8da938
-
SHA256
f085f0ece42084f2ce26c28a27ebc9457ae32b2ecd632b3073500b7e17805659
-
SHA512
da0d4d63ce9ecfc3d892b20f55be6769a5d28a77d9c3b7f4cb22abc51e3be604c102c1e6b7c4d7464dc8dc3f4730b204654c82292ad8899004e90cd7b4a66a5d
-
SSDEEP
49152:gbB0FQB5MLPlG5/8uMLq0u5hRD5pbjX7i4l8B/oy6kRMF4mK/LPS/yYCxL:g90sW0dRfj7O/oyBqi/TS/yYCxL
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Doc-102PO-207841001jpg.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Doc-102PO-207841001jpg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
Doc-102PO-207841001jpg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Doc-102PO-207841001jpg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Coxsx = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vfiatkcr\\Coxsx.exe\"" Doc-102PO-207841001jpg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Doc-102PO-207841001jpg.exedescription pid process target process PID 1100 set thread context of 1504 1100 Doc-102PO-207841001jpg.exe Doc-102PO-207841001jpg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 2100 ipconfig.exe 1564 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exeDoc-102PO-207841001jpg.exepid process 2144 powershell.exe 2144 powershell.exe 1504 Doc-102PO-207841001jpg.exe 1504 Doc-102PO-207841001jpg.exe 1504 Doc-102PO-207841001jpg.exe 1504 Doc-102PO-207841001jpg.exe 1504 Doc-102PO-207841001jpg.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Doc-102PO-207841001jpg.exepowershell.exeDoc-102PO-207841001jpg.exedescription pid process Token: SeDebugPrivilege 1100 Doc-102PO-207841001jpg.exe Token: SeDebugPrivilege 2144 powershell.exe Token: SeDebugPrivilege 1504 Doc-102PO-207841001jpg.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Doc-102PO-207841001jpg.execmd.execmd.exedescription pid process target process PID 1100 wrote to memory of 1636 1100 Doc-102PO-207841001jpg.exe cmd.exe PID 1100 wrote to memory of 1636 1100 Doc-102PO-207841001jpg.exe cmd.exe PID 1636 wrote to memory of 2100 1636 cmd.exe ipconfig.exe PID 1636 wrote to memory of 2100 1636 cmd.exe ipconfig.exe PID 1100 wrote to memory of 2144 1100 Doc-102PO-207841001jpg.exe powershell.exe PID 1100 wrote to memory of 2144 1100 Doc-102PO-207841001jpg.exe powershell.exe PID 1100 wrote to memory of 2372 1100 Doc-102PO-207841001jpg.exe cmd.exe PID 1100 wrote to memory of 2372 1100 Doc-102PO-207841001jpg.exe cmd.exe PID 2372 wrote to memory of 1564 2372 cmd.exe ipconfig.exe PID 2372 wrote to memory of 1564 2372 cmd.exe ipconfig.exe PID 1100 wrote to memory of 1504 1100 Doc-102PO-207841001jpg.exe Doc-102PO-207841001jpg.exe PID 1100 wrote to memory of 1504 1100 Doc-102PO-207841001jpg.exe Doc-102PO-207841001jpg.exe PID 1100 wrote to memory of 1504 1100 Doc-102PO-207841001jpg.exe Doc-102PO-207841001jpg.exe PID 1100 wrote to memory of 1504 1100 Doc-102PO-207841001jpg.exe Doc-102PO-207841001jpg.exe PID 1100 wrote to memory of 1504 1100 Doc-102PO-207841001jpg.exe Doc-102PO-207841001jpg.exe PID 1100 wrote to memory of 1504 1100 Doc-102PO-207841001jpg.exe Doc-102PO-207841001jpg.exe -
outlook_office_path 1 IoCs
Processes:
Doc-102PO-207841001jpg.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe -
outlook_win_path 1 IoCs
Processes:
Doc-102PO-207841001jpg.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Doc-102PO-207841001jpg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc-102PO-207841001jpg.exe"C:\Users\Admin\AppData\Local\Temp\Doc-102PO-207841001jpg.exe"
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig/release
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exeipconfig /release
- Gathers network information
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig/renew
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exeipconfig /renew
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\Doc-102PO-207841001jpg.exeC:\Users\Admin\AppData\Local\Temp\Doc-102PO-207841001jpg.exe
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Doc-102PO-207841001jpg.exe.logFilesize
1KB
MD5819dc687f4da92e5850508c10429fc9f
SHA1d3441a3c46ddc99d03583be6b2ab02615baa60be
SHA256357a8ea90e614160a9179ac7eb5e3ff159855a037b1bd0deecbd7d3e3a243119
SHA512671735133e2643d2ec84511cb0a89dad9082e6255020fef4cd4e37b7a7207a06a36f4f22c646ce6854d6e244b2b9e090dc87aa3309a349d5b20a1a014bf1f7ee
-
memory/1100-139-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10MB
-
memory/1100-133-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10MB
-
memory/1100-134-0x000001D4F2130000-0x000001D4F2152000-memory.dmpFilesize
136KB
-
memory/1100-132-0x000001D4F1B00000-0x000001D4F1D1A000-memory.dmpFilesize
2MB
-
memory/1100-147-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10MB
-
memory/1504-149-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10MB
-
memory/1504-145-0x0000000140000000-mapping.dmp
-
memory/1504-148-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10MB
-
memory/1504-150-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10MB
-
memory/1504-144-0x0000000140000000-0x0000000140098000-memory.dmpFilesize
608KB
-
memory/1564-143-0x0000000000000000-mapping.dmp
-
memory/1636-135-0x0000000000000000-mapping.dmp
-
memory/2100-136-0x0000000000000000-mapping.dmp
-
memory/2144-141-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10MB
-
memory/2144-140-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10MB
-
memory/2144-138-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmpFilesize
10MB
-
memory/2144-137-0x0000000000000000-mapping.dmp
-
memory/2372-142-0x0000000000000000-mapping.dmp