Analysis
-
max time kernel
246s -
max time network
291s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26-12-2023 01:41
General
-
Target
4a1680c6aa24f5dc0e4547a05503f041.exe
-
Size
285KB
-
MD5
4a1680c6aa24f5dc0e4547a05503f041
-
SHA1
37b4738cb4a436fe80d821d128da5ed77fb568bd
-
SHA256
760fc7d07f405516296d896908f6b7a99c5dd62ae2e5edba3dff91f146b4599c
-
SHA512
ba971694f42612d4366665fb55c033207c2fefa61b0410d04dfa3cd848de6bc6c4a4d65727e37c5073f6abf7f07fd358de0ff14c9c6218c357888e5134b52f7e
-
SSDEEP
6144:sKuyRacZZQzliDoUh58+ZungB5eHbyPmUL0RKkom2EtFhMMYAR48HQ:sKuYbioDlz8+ZUiY+PoRKkomh2xWz
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a1680c6aa24f5dc0e4547a05503f041.exe"C:\Users\Admin\AppData\Local\Temp\4a1680c6aa24f5dc0e4547a05503f041.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\4a1680c6aa24f5dc0e4547a05503f041.exeC:\Users\Admin\AppData\Local\Temp\4a1680c6aa24f5dc0e4547a05503f041.exe startC:\Users\Admin\AppData\Roaming\B4D75\27024.exe%C:\Users\Admin\AppData\Roaming\B4D752⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4a1680c6aa24f5dc0e4547a05503f041.exeC:\Users\Admin\AppData\Local\Temp\4a1680c6aa24f5dc0e4547a05503f041.exe startC:\Program Files (x86)\75C62\lvvm.exe%C:\Program Files (x86)\75C622⤵
-
-
C:\Program Files (x86)\LP\24CB\25AA.tmp"C:\Program Files (x86)\LP\24CB\25AA.tmp"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD500677af21508e80ece326e0dbf4a6f7a
SHA1017112167b456be0742001221e1963ddf92e3455
SHA2567b501b1fb142606bc7dc15e1052b184abdcaa90046f32fa5e6b195901d1fca66
SHA51234e2040b255a10e74cf36ce75c1de8535fc06e6d8fd5272b543523ac8934764054b5a2942388f27851c87fd11a17091114e790d539ca35f25f7ac9cd498bea21
-
Filesize
1KB
MD55410e9ad84acfba0869186cdff84eb2a
SHA17ab213eaff3d708e549dc0090ba143b3fdb12fef
SHA256681c2007d682d095e291e85155e56b9525a70b93150f4fc67c08e2fb56165197
SHA512c0a2e4d0652a658b28bc13f05ed99055241f98c1131c75179b9c4c8631e7a9d8ed82f641eff40b745a0134e923edf01bf8cebef753a353fea691eaff9bb6f078
-
Filesize
600B
MD5605d7842b6591102b983a958c863e15d
SHA1de2e32bff7eeacb68f881ebc0d00c5d8c6f3ee67
SHA256ec8bb9251b3004253253be6e66a7638b65395342bae28202e8cf96b3e481aafd
SHA5126692c02d3e211ad452c929fca74878ffae0df7826b92187af44e6fc28a9783578147f6c42922f25eb10bae873309fa22f2248ab81b975992834e3257e25e669f
-
Filesize
1KB
MD5416074e443994c50db2ec48e7dbc91ff
SHA172898459497c3668cd828338ac9d096728c1d54a
SHA2568cd5d7a8bfdcb4d2c23a425d7b36823a8372b2d66857f2399597dd557cb6de7f
SHA512a4fd6b9dd2497d2dc6d6d8f8e6b4d36e5d9892b627dee80dd76bd80062ff2eead8f26752e5ed59cf89e2a82bcc0756fac89d7e337ed0ce4f7dd064d90c5b70a8
-
Filesize
144KB
-
Filesize
424KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
424KB
-
Filesize
1024KB
-
Filesize
424KB
-
Filesize
1024KB
-
Filesize
116KB
-
Filesize
1024KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
1024KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
1024KB
-
Filesize
424KB