a75544522b73246b0e503921eebc40936f6d17512e3297e843a6e5c787d23908

Analysis

max time kernel
161s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Q614-TX897- FM- MANAGER- One International Pte Ltd.scr
Size

72KB
MD5

653884a8e7ef6081b4d7320cd0fc66c2
SHA1

58adfa71d02771d39451c5a3bf4a53cb7601abe8
SHA256

a75544522b73246b0e503921eebc40936f6d17512e3297e843a6e5c787d23908
SHA512

c55d87d8f8e226a97a729b7b98d6f193f833bfc2e1354f309c9fd3d85c762e0b057cd517f378d3cf8b2d475da8ef27b86b0fbabe1c0e33bb634fe0549be57774
SSDEEP

96:0wWWCTi+o3BPk4tqS72wO5DEyLzw5xU9eoW9/UvzUh4+6e7ezuGE4H0JL1JZOLzj:DmBwBc4tN72dOthlebUEpzup1pq

Score

7^/10

collection persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4156	MSBuild.exe

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fnozmg = "C:\\Users\\Admin\\AppData\\Roaming\\Fnozmg.exe"	Q614-TX897- FM- MANAGER- One International Pte Ltd.scr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 4156	4716	Q614-TX897- FM- MANAGER- One International Pte Ltd.scr	97

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4156	MSBuild.exe
4156	MSBuild.exe
4156	MSBuild.exe
4156	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	Q614-TX897- FM- MANAGER- One International Pte Ltd.scr
Token: SeDebugPrivilege	4156	MSBuild.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4156	4716	Q614-TX897- FM- MANAGER- One International Pte Ltd.scr	97
PID 4716 wrote to memory of 4156	4716	Q614-TX897- FM- MANAGER- One International Pte Ltd.scr	97
PID 4716 wrote to memory of 4156	4716	Q614-TX897- FM- MANAGER- One International Pte Ltd.scr	97
PID 4716 wrote to memory of 4156	4716	Q614-TX897- FM- MANAGER- One International Pte Ltd.scr	97
PID 4716 wrote to memory of 4156	4716	Q614-TX897- FM- MANAGER- One International Pte Ltd.scr	97
PID 4716 wrote to memory of 4156	4716	Q614-TX897- FM- MANAGER- One International Pte Ltd.scr	97

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Q614-TX897- FM- MANAGER- One International Pte Ltd.scr
"C:\Users\Admin\AppData\Local\Temp\Q614-TX897- FM- MANAGER- One International Pte Ltd.scr" /S
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\1485B29524EF63EB83DF771D39CCA767\64\sqlite.interop.dll

Filesize
1.7MB

MD5
02f50a23e31d1f21aa21ae52faf3c05a

SHA1
5b21234729dedfa1b456138872ef2a046b9ee86f

SHA256
5f0e72e1839db4aa41f560e0a68c7a95c9e1656bc2f4f4ff64803655d02e5272

SHA512
bc2fcca125506d9b762df4e9df24a907b9e554d857e705945ae252e7e6b50dada043ef0e69828b780ac9b569053fcf912c27a770469a80f1f6094c146afdb9b0

Download Submit
memory/4156-46-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-2217-0x000001AFE4940000-0x000001AFE49BA000-memory.dmp

Filesize
488KB

Download
memory/4156-12-0x000001AFE4170000-0x000001AFE4180000-memory.dmp

Filesize
64KB

Download
memory/4156-15-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-2221-0x00007FFF611E0000-0x00007FFF61CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4156-9-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/4156-2216-0x000001AFE4770000-0x000001AFE4796000-memory.dmp

Filesize
152KB

Download
memory/4156-2215-0x000001AFE47B0000-0x000001AFE47EA000-memory.dmp

Filesize
232KB

Download
memory/4156-2214-0x000001AFE46A0000-0x000001AFE470C000-memory.dmp

Filesize
432KB

Download
memory/4156-11-0x00007FFF611E0000-0x00007FFF61CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4156-2209-0x000001AFE4490000-0x000001AFE469E000-memory.dmp

Filesize
2.1MB

Download
memory/4156-2208-0x000001AFE4080000-0x000001AFE411E000-memory.dmp

Filesize
632KB

Download
memory/4156-16-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-18-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-20-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-22-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-24-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-26-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-28-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-30-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-34-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-32-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-44-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-38-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-40-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-42-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-36-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-13-0x000001AFE4180000-0x000001AFE4288000-memory.dmp

Filesize
1.0MB

Download
memory/4156-66-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-50-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-52-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-54-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-56-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-58-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-60-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-62-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-64-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-48-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-68-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-70-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-72-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-74-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-76-0x000001AFE4180000-0x000001AFE4284000-memory.dmp

Filesize
1.0MB

Download
memory/4156-850-0x00007FFF611E0000-0x00007FFF61CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4156-938-0x000001AFE4170000-0x000001AFE4180000-memory.dmp

Filesize
64KB

Download
memory/4156-2207-0x000001AFC9F80000-0x000001AFC9F88000-memory.dmp

Filesize
32KB

Download
memory/4716-7-0x000001EBCA9B0000-0x000001EBCA9C0000-memory.dmp

Filesize
64KB

Download
memory/4716-6-0x00007FFF611E0000-0x00007FFF61CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4716-5-0x000001EBCAD80000-0x000001EBCADCC000-memory.dmp

Filesize
304KB

Download
memory/4716-4-0x000001EBCAC10000-0x000001EBCAD10000-memory.dmp

Filesize
1024KB

Download
memory/4716-3-0x000001EBCAAC0000-0x000001EBCABD0000-memory.dmp

Filesize
1.1MB

Download
memory/4716-2-0x000001EBCA9B0000-0x000001EBCA9C0000-memory.dmp

Filesize
64KB

Download
memory/4716-1-0x00007FFF611E0000-0x00007FFF61CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4716-0-0x000001EBB0440000-0x000001EBB0458000-memory.dmp

Filesize
96KB

Download
memory/4716-14-0x00007FFF611E0000-0x00007FFF61CA1000-memory.dmp

Filesize
10.8MB

Download