bddf24d7ae594e5398077966c512aa4b68722063cc0735d0d3a4900eabe010ab

General

Target

3b9617f561c549d43ee612b00c635ab1.exe
Size

229KB
MD5

3b9617f561c549d43ee612b00c635ab1
SHA1

1b2cc5c3a3694e1600a0c358df605d0c24047b3e
SHA256

bddf24d7ae594e5398077966c512aa4b68722063cc0735d0d3a4900eabe010ab
SHA512

4e819a3b66ea94b2ba3464a2f32d9394c45f35c416bce8e6f60d290d4b35c85489a8782d06409635648c8d650fcb16139f93c8918431ac457122f284c1ac8bd3
SSDEEP

6144:FcNkgTq4uXFFcz1c6afbkXV1tnN8MZZ2LuryV:FcNkgTq42cBPafbGV1xKV

Score

10^/10

collection discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\MStask = "{11BF7463-AF81-4E75-BF83-D0CEDA92BA50}"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
2408	Pinch.exe
2732	EDITOR.EXE
2516	svchost.exe

Loads dropped DLL 9 IoCs

pid	Process
2176	3b9617f561c549d43ee612b00c635ab1.exe
2176	3b9617f561c549d43ee612b00c635ab1.exe
2176	3b9617f561c549d43ee612b00c635ab1.exe
2176	3b9617f561c549d43ee612b00c635ab1.exe
2176	3b9617f561c549d43ee612b00c635ab1.exe
2176	3b9617f561c549d43ee612b00c635ab1.exe
2176	3b9617f561c549d43ee612b00c635ab1.exe
2176	3b9617f561c549d43ee612b00c635ab1.exe
2176	3b9617f561c549d43ee612b00c635ab1.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	Pinch.exe
File opened for modification	C:\Windows\svchost.exe	Pinch.exe
File created	C:\Windows\p2sys.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11BF7463-AF81-4E75-BF83-D0CEDA92BA50}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11BF7463-AF81-4E75-BF83-D0CEDA92BA50}\InProcServer32\ = "p2sys.dll"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11BF7463-AF81-4E75-BF83-D0CEDA92BA50}\InProcServer32	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2516	svchost.exe
2516	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	Pinch.exe
Token: SeDebugPrivilege	2516	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2408	2176	3b9617f561c549d43ee612b00c635ab1.exe	18
PID 2176 wrote to memory of 2408	2176	3b9617f561c549d43ee612b00c635ab1.exe	18
PID 2176 wrote to memory of 2408	2176	3b9617f561c549d43ee612b00c635ab1.exe	18
PID 2176 wrote to memory of 2408	2176	3b9617f561c549d43ee612b00c635ab1.exe	18
PID 2176 wrote to memory of 2732	2176	3b9617f561c549d43ee612b00c635ab1.exe	17
PID 2176 wrote to memory of 2732	2176	3b9617f561c549d43ee612b00c635ab1.exe	17
PID 2176 wrote to memory of 2732	2176	3b9617f561c549d43ee612b00c635ab1.exe	17
PID 2176 wrote to memory of 2732	2176	3b9617f561c549d43ee612b00c635ab1.exe	17
PID 2408 wrote to memory of 2516	2408	Pinch.exe	16
PID 2408 wrote to memory of 2516	2408	Pinch.exe	16
PID 2408 wrote to memory of 2516	2408	Pinch.exe	16
PID 2408 wrote to memory of 2516	2408	Pinch.exe	16

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3b9617f561c549d43ee612b00c635ab1.exe
"C:\Users\Admin\AppData\Local\Temp\3b9617f561c549d43ee612b00c635ab1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\EDITOR.EXE
  "C:\Users\Admin\AppData\Local\Temp\EDITOR.EXE"
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\Pinch.exe
  "C:\Users\Admin\AppData\Local\Temp\Pinch.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2408

C:\Windows\svchost.exe
"C:\Windows\svchost.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\EDITOR.EXE

Filesize
92KB

MD5
e2a9e5488e69ecf0669347add2e4336f

SHA1
91090791712ee30bf4e3542eaef36a76997c8b36

SHA256
30fa5c5f66765b1d8bde1b8f477d4fed6559a9160e929bacc74fe1422dd380ab

SHA512
bb8edc971706d79064bd6021ea31fc09a77e92e710905589888347db8947ecddf0b6f9fe3ddc825f1a02c88e77e133c3e32b5c931233ab6f0c996172084f9b56

Download Submit
\Users\Admin\AppData\Local\Temp\Pinch.exe

Filesize
11KB

MD5
92359313b497c7c2497d2b41d6b6adcc

SHA1
b545d624a38661a81fa478382be5c6f092809839

SHA256
08a19e53f21bbc4a3a81e12a57670775f23cf22766d6df830e8ea6ecc00e1efd

SHA512
51f61a3219aab02b3224dbe52fb9e91b26ebfbc702454d1b62b5f256e373f950d5f073f35cc8c116644e3f2044600c84a9434b5e6218e7c52bb6335b52c227eb

Download Submit
memory/2176-0-0x0000000000400000-0x000000000043AFE4-memory.dmp

Filesize
235KB

Download
memory/2176-35-0x00000000027B0000-0x000000000284A000-memory.dmp

Filesize
616KB

Download
memory/2176-33-0x0000000000400000-0x000000000043AFE4-memory.dmp

Filesize
235KB

Download
memory/2176-32-0x00000000027A0000-0x000000000283A000-memory.dmp

Filesize
616KB

Download
memory/2408-46-0x0000000013140000-0x0000000013176000-memory.dmp

Filesize
216KB

Download
memory/2516-52-0x0000000013140000-0x0000000013176000-memory.dmp

Filesize
216KB

Download
memory/2732-40-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2732-38-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2732-51-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2732-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads