Analysis
-
max time kernel
230s -
max time network
255s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 20:49
Static task
static1
Behavioral task
behavioral1
Sample
microsoft10converters.exe
Resource
win7-20230220-en
General
-
Target
microsoft10converters.exe
-
Size
658KB
-
MD5
5e9a63f5b3d8f53478a2889c0eefd510
-
SHA1
d6d545146b969ac2ea389a1f11ffcda377549da2
-
SHA256
4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
-
SHA512
2ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
SSDEEP
12288:gXQnnE6+s3WsZ/lkwR939lgKFWRg1xY0VcRuaHuatAUz3huJ7XrjaJ+:gXQnnYsNHXR9NlgobVcUK7UXrj++
Malware Config
Signatures
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/4496-138-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4496-138-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView -
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4496-138-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
microsoft10converters.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation microsoft10converters.exe -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 3352 Windows Update.exe 3700 Windows Update.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
microsoft10converters.exedescription ioc process File opened for modification C:\Windows\assembly\Desktop.ini microsoft10converters.exe File created C:\Windows\assembly\Desktop.ini microsoft10converters.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 36 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
microsoft10converters.exeWindows Update.exedescription pid process target process PID 3768 set thread context of 4496 3768 microsoft10converters.exe microsoft10converters.exe PID 3352 set thread context of 3700 3352 Windows Update.exe Windows Update.exe -
Drops file in Windows directory 3 IoCs
Processes:
microsoft10converters.exedescription ioc process File created C:\Windows\assembly\Desktop.ini microsoft10converters.exe File opened for modification C:\Windows\assembly\Desktop.ini microsoft10converters.exe File opened for modification C:\Windows\assembly microsoft10converters.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
microsoft10converters.exeWindows Update.exepid process 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3768 microsoft10converters.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe 3352 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
microsoft10converters.exeWindows Update.exeWindows Update.exedescription pid process Token: SeDebugPrivilege 3768 microsoft10converters.exe Token: SeDebugPrivilege 3352 Windows Update.exe Token: SeDebugPrivilege 3700 Windows Update.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
microsoft10converters.exemicrosoft10converters.exeWindows Update.exedescription pid process target process PID 3768 wrote to memory of 340 3768 microsoft10converters.exe cmd.exe PID 3768 wrote to memory of 340 3768 microsoft10converters.exe cmd.exe PID 3768 wrote to memory of 340 3768 microsoft10converters.exe cmd.exe PID 3768 wrote to memory of 4496 3768 microsoft10converters.exe microsoft10converters.exe PID 3768 wrote to memory of 4496 3768 microsoft10converters.exe microsoft10converters.exe PID 3768 wrote to memory of 4496 3768 microsoft10converters.exe microsoft10converters.exe PID 3768 wrote to memory of 4496 3768 microsoft10converters.exe microsoft10converters.exe PID 3768 wrote to memory of 4496 3768 microsoft10converters.exe microsoft10converters.exe PID 3768 wrote to memory of 4496 3768 microsoft10converters.exe microsoft10converters.exe PID 3768 wrote to memory of 4496 3768 microsoft10converters.exe microsoft10converters.exe PID 3768 wrote to memory of 4496 3768 microsoft10converters.exe microsoft10converters.exe PID 4496 wrote to memory of 3352 4496 microsoft10converters.exe Windows Update.exe PID 4496 wrote to memory of 3352 4496 microsoft10converters.exe Windows Update.exe PID 4496 wrote to memory of 3352 4496 microsoft10converters.exe Windows Update.exe PID 3352 wrote to memory of 976 3352 Windows Update.exe cmd.exe PID 3352 wrote to memory of 976 3352 Windows Update.exe cmd.exe PID 3352 wrote to memory of 976 3352 Windows Update.exe cmd.exe PID 3352 wrote to memory of 3700 3352 Windows Update.exe Windows Update.exe PID 3352 wrote to memory of 3700 3352 Windows Update.exe Windows Update.exe PID 3352 wrote to memory of 3700 3352 Windows Update.exe Windows Update.exe PID 3352 wrote to memory of 3700 3352 Windows Update.exe Windows Update.exe PID 3352 wrote to memory of 3700 3352 Windows Update.exe Windows Update.exe PID 3352 wrote to memory of 3700 3352 Windows Update.exe Windows Update.exe PID 3352 wrote to memory of 3700 3352 Windows Update.exe Windows Update.exe PID 3352 wrote to memory of 3700 3352 Windows Update.exe Windows Update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe"C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe"C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\microsoft10converters.exe.logFilesize
408B
MD542157868488d3ef98c00e3fa12f064be
SHA1aad391be9ac3f6ce1ced49583690486a5f4186fb
SHA256b9520170e84597186ba5cc223b9c2773f70d0cda088950bae2182e3b2237995c
SHA5128f4a4bd63ceefc34158ea23f3a73dcc2848eeacdba8355d1251a96b4e0c18e2f3b0c4939be359f874f81fe4ee63283b8be43a70fe2dbaa2e64784333d10a2471
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
59B
MD59b294a29cba9a63552604ad89c4d9444
SHA18e5bb542f31fccad06e69502c7dba5a62e9b9cb9
SHA256a3f87150ecc0223f9099533d33c8839a435a2276bf243c7fbf0f063a182d31e1
SHA512c45e8ae93eb82aefa86f7e46cbf47dfed4738b88b94e37925bc716a9b304ac6827f55d007f676783df6fed3a84d552f00ddf2dd00cbffdc1348f215878030a51
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
89KB
MD584c42d0f2c1ae761bef884638bc1eacd
SHA14353881e7f4e9c7610f4e0489183b55bb58bb574
SHA256331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
SHA51243c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
memory/3352-153-0x0000000001040000-0x0000000001050000-memory.dmpFilesize
64KB
-
memory/3352-162-0x0000000001040000-0x0000000001050000-memory.dmpFilesize
64KB
-
memory/3700-158-0x00000000010A0000-0x00000000010B0000-memory.dmpFilesize
64KB
-
memory/3700-163-0x00000000010A0000-0x00000000010B0000-memory.dmpFilesize
64KB
-
memory/3768-133-0x0000000001350000-0x0000000001360000-memory.dmpFilesize
64KB
-
memory/3768-137-0x0000000001350000-0x0000000001360000-memory.dmpFilesize
64KB
-
memory/4496-145-0x0000000001360000-0x0000000001370000-memory.dmpFilesize
64KB
-
memory/4496-140-0x0000000001360000-0x0000000001370000-memory.dmpFilesize
64KB
-
memory/4496-139-0x0000000001360000-0x0000000001370000-memory.dmpFilesize
64KB
-
memory/4496-138-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB