Analysis
-
max time kernel
154s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 09:09
Static task
static1
Behavioral task
behavioral1
Sample
microsoft10converters.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
microsoft10converters.exe
Resource
win10v2004-20230221-en
General
-
Target
microsoft10converters.exe
-
Size
658KB
-
MD5
5e9a63f5b3d8f53478a2889c0eefd510
-
SHA1
d6d545146b969ac2ea389a1f11ffcda377549da2
-
SHA256
4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
-
SHA512
2ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
SSDEEP
12288:gXQnnE6+s3WsZ/lkwR939lgKFWRg1xY0VcRuaHuatAUz3huJ7XrjaJ+:gXQnnYsNHXR9NlgobVcUK7UXrj++
Malware Config
Signatures
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3780-137-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral2/memory/368-163-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/368-165-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/368-167-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3780-137-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral2/memory/4460-171-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4460-173-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4460-177-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/4460-181-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral2/memory/3780-137-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral2/memory/368-163-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/368-165-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/368-167-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4460-171-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4460-173-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4460-177-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/4460-181-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
microsoft10converters.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation microsoft10converters.exe -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 3460 Windows Update.exe 2156 Windows Update.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Windows Update.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
microsoft10converters.exedescription ioc process File opened for modification C:\Windows\assembly\Desktop.ini microsoft10converters.exe File created C:\Windows\assembly\Desktop.ini microsoft10converters.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 whatismyipaddress.com 10 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
microsoft10converters.exeWindows Update.exeWindows Update.exedescription pid process target process PID 2708 set thread context of 3780 2708 microsoft10converters.exe microsoft10converters.exe PID 3460 set thread context of 2156 3460 Windows Update.exe Windows Update.exe PID 2156 set thread context of 368 2156 Windows Update.exe vbc.exe PID 2156 set thread context of 4460 2156 Windows Update.exe vbc.exe -
Drops file in Windows directory 3 IoCs
Processes:
microsoft10converters.exedescription ioc process File opened for modification C:\Windows\assembly microsoft10converters.exe File created C:\Windows\assembly\Desktop.ini microsoft10converters.exe File opened for modification C:\Windows\assembly\Desktop.ini microsoft10converters.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
microsoft10converters.exeWindows Update.exeWindows Update.exepid process 2708 microsoft10converters.exe 2708 microsoft10converters.exe 2708 microsoft10converters.exe 2708 microsoft10converters.exe 2708 microsoft10converters.exe 3460 Windows Update.exe 3460 Windows Update.exe 3460 Windows Update.exe 2708 microsoft10converters.exe 2708 microsoft10converters.exe 3460 Windows Update.exe 3460 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 3460 Windows Update.exe 3460 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe 2156 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
microsoft10converters.exeWindows Update.exeWindows Update.exedescription pid process Token: SeDebugPrivilege 2708 microsoft10converters.exe Token: SeDebugPrivilege 3460 Windows Update.exe Token: SeDebugPrivilege 2156 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Update.exepid process 2156 Windows Update.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
microsoft10converters.exemicrosoft10converters.exeWindows Update.exeWindows Update.exedescription pid process target process PID 2708 wrote to memory of 1988 2708 microsoft10converters.exe cmd.exe PID 2708 wrote to memory of 1988 2708 microsoft10converters.exe cmd.exe PID 2708 wrote to memory of 1988 2708 microsoft10converters.exe cmd.exe PID 2708 wrote to memory of 3780 2708 microsoft10converters.exe microsoft10converters.exe PID 2708 wrote to memory of 3780 2708 microsoft10converters.exe microsoft10converters.exe PID 2708 wrote to memory of 3780 2708 microsoft10converters.exe microsoft10converters.exe PID 2708 wrote to memory of 3780 2708 microsoft10converters.exe microsoft10converters.exe PID 2708 wrote to memory of 3780 2708 microsoft10converters.exe microsoft10converters.exe PID 2708 wrote to memory of 3780 2708 microsoft10converters.exe microsoft10converters.exe PID 2708 wrote to memory of 3780 2708 microsoft10converters.exe microsoft10converters.exe PID 2708 wrote to memory of 3780 2708 microsoft10converters.exe microsoft10converters.exe PID 3780 wrote to memory of 3460 3780 microsoft10converters.exe Windows Update.exe PID 3780 wrote to memory of 3460 3780 microsoft10converters.exe Windows Update.exe PID 3780 wrote to memory of 3460 3780 microsoft10converters.exe Windows Update.exe PID 3460 wrote to memory of 3088 3460 Windows Update.exe cmd.exe PID 3460 wrote to memory of 3088 3460 Windows Update.exe cmd.exe PID 3460 wrote to memory of 3088 3460 Windows Update.exe cmd.exe PID 3460 wrote to memory of 2156 3460 Windows Update.exe Windows Update.exe PID 3460 wrote to memory of 2156 3460 Windows Update.exe Windows Update.exe PID 3460 wrote to memory of 2156 3460 Windows Update.exe Windows Update.exe PID 3460 wrote to memory of 2156 3460 Windows Update.exe Windows Update.exe PID 3460 wrote to memory of 2156 3460 Windows Update.exe Windows Update.exe PID 3460 wrote to memory of 2156 3460 Windows Update.exe Windows Update.exe PID 3460 wrote to memory of 2156 3460 Windows Update.exe Windows Update.exe PID 3460 wrote to memory of 2156 3460 Windows Update.exe Windows Update.exe PID 2156 wrote to memory of 368 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 368 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 368 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 368 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 368 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 368 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 368 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 368 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 368 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 4460 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 4460 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 4460 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 4460 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 4460 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 4460 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 4460 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 4460 2156 Windows Update.exe vbc.exe PID 2156 wrote to memory of 4460 2156 Windows Update.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe"C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe"C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
59B
MD59b294a29cba9a63552604ad89c4d9444
SHA18e5bb542f31fccad06e69502c7dba5a62e9b9cb9
SHA256a3f87150ecc0223f9099533d33c8839a435a2276bf243c7fbf0f063a182d31e1
SHA512c45e8ae93eb82aefa86f7e46cbf47dfed4738b88b94e37925bc716a9b304ac6827f55d007f676783df6fed3a84d552f00ddf2dd00cbffdc1348f215878030a51
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
89KB
MD584c42d0f2c1ae761bef884638bc1eacd
SHA14353881e7f4e9c7610f4e0489183b55bb58bb574
SHA256331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
SHA51243c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
658KB
MD55e9a63f5b3d8f53478a2889c0eefd510
SHA1d6d545146b969ac2ea389a1f11ffcda377549da2
SHA2564c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c
SHA5122ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87
-
memory/368-167-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/368-163-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/368-165-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2156-157-0x0000000001220000-0x0000000001230000-memory.dmpFilesize
64KB
-
memory/2156-155-0x0000000001220000-0x0000000001230000-memory.dmpFilesize
64KB
-
memory/2156-169-0x0000000001220000-0x0000000001230000-memory.dmpFilesize
64KB
-
memory/2156-170-0x0000000001220000-0x0000000001230000-memory.dmpFilesize
64KB
-
memory/2708-133-0x0000000000F80000-0x0000000000F90000-memory.dmpFilesize
64KB
-
memory/3460-156-0x0000000000F10000-0x0000000000F20000-memory.dmpFilesize
64KB
-
memory/3780-145-0x0000000001250000-0x0000000001260000-memory.dmpFilesize
64KB
-
memory/3780-138-0x0000000001250000-0x0000000001260000-memory.dmpFilesize
64KB
-
memory/3780-137-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/4460-171-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4460-173-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4460-177-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4460-181-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB