b23cb04afe59fee16c95ef5d24a67cb493d4ea88b62f6996e54493548acad6c2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
Size

92KB
MD5

6c482e3d0fdc8af0182d543371ca5176
SHA1

e4de59423b77477cc593b7f31d08252107444524
SHA256

0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7
SHA512

ed217f7c2a0b0ca7716c0c04dc369598371d997590437f70ce68147276ef0cc8e3539306abcd5d16266dc5d4a6b984eab9e8fc5348dc2f6607ddea3eed4e0411
SSDEEP

1536:ReybNDac/BiUkGgxjDUsFFtZjSrHOUTS6r17Y4HbmxwRwW:lNDgUm5Fi6Uu6r17p7zV

Score

9^/10

persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (9950) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

LshO:exe

pid process

2908 LshO:exe
Executes dropped EXE 3 IoCs

Processes:

LshO:exe59a6z0.exeYw3:exe

pid process

2908 LshO:exe
2732 59a6z0.exe
2840 Yw3:exe

pid	process
2908	LshO:exe

pid	process
2908	LshO:exe
2732	59a6z0.exe
2840	Yw3:exe

Loads dropped DLL 6 IoCs

Processes:

0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.execmd.exe59a6z0.exe

pid	process
2964	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
2964	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
1728	cmd.exe
1728	cmd.exe
2732	59a6z0.exe
2732	59a6z0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yhk7Q0 = "C:\\Users\\Admin\\AppData\\Local\\vLWK\\zbFFHX.exe"	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Yw3:exe

description ioc process

File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI Yw3:exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	Yw3:exe

Drops file in Program Files directory 64 IoCs

Processes:

Yw3:exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_GreenTea.gif	Yw3:exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json	Yw3:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho	Yw3:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.locked	Yw3:exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt	Yw3:exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0304861.WMF.locked	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\OUTLVBA.DLL.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	Yw3:exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML	Yw3:exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.readme_txt	Yw3:exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.readme_txt	Yw3:exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.readme_txt	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.readme_txt	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ADD.GIF.locked	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_choosefont.gif.readme_txt	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03143I.JPG.locked	Yw3:exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.readme_txt	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Trek.eftx.readme_txt	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.SqlServerCe.dll	Yw3:exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9.locked	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apex.thmx.readme_txt	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg	Yw3:exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	Yw3:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.locked	Yw3:exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.locked	Yw3:exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll	Yw3:exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\micaut.dll	Yw3:exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdaosp.dll	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0291794.WMF.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\Java\jre7\bin\javafx-font.dll	Yw3:exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt.locked	Yw3:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.locked	Yw3:exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.locked	Yw3:exe
File opened for modification	C:\Program Files\Windows Mail\it-IT\WinMail.exe.mui	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_TexturedBlue.gif	Yw3:exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt.readme_txt	Yw3:exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf.locked	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0314068.JPG.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	Yw3:exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.locked	Yw3:exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBCN6.CHM.locked	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0172067.WMF.locked	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0304853.WMF.readme_txt	Yw3:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR30B.GIF.readme_txt	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR15F.GIF.locked	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNoteUI.dll	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATALOG.XML.readme_txt	Yw3:exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\Java\jre7\bin\j2pcsc.dll.locked	Yw3:exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\PACBELL.NET.XML.locked	Yw3:exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll	Yw3:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0098497.WMF.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\PST8PDT.readme_txt	Yw3:exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui	Yw3:exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 2 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exenet.exe

pid process

2812 net.exe
2304 net.exe

pid	process
2812	net.exe
2304	net.exe

NTFS ADS 2 IoCs

Processes:

0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe59a6z0.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\LshO:exe	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
File created	C:\Users\Admin\AppData\Local\Yw3:exe	59a6z0.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.execmd.exeLshO:exe59a6z0.exe

description	pid	process	target process
PID 2964 wrote to memory of 1728	2964	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe	cmd.exe
PID 2964 wrote to memory of 1728	2964	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe	cmd.exe
PID 2964 wrote to memory of 1728	2964	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe	cmd.exe
PID 2964 wrote to memory of 1728	2964	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe	cmd.exe
PID 2964 wrote to memory of 2908	2964	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe	LshO:exe
PID 2964 wrote to memory of 2908	2964	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe	LshO:exe
PID 2964 wrote to memory of 2908	2964	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe	LshO:exe
PID 2964 wrote to memory of 2908	2964	0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe	LshO:exe
PID 1728 wrote to memory of 2732	1728	cmd.exe	59a6z0.exe
PID 1728 wrote to memory of 2732	1728	cmd.exe	59a6z0.exe
PID 1728 wrote to memory of 2732	1728	cmd.exe	59a6z0.exe
PID 1728 wrote to memory of 2732	1728	cmd.exe	59a6z0.exe
PID 2908 wrote to memory of 2812	2908	LshO:exe	net.exe
PID 2908 wrote to memory of 2812	2908	LshO:exe	net.exe
PID 2908 wrote to memory of 2812	2908	LshO:exe	net.exe
PID 2908 wrote to memory of 2812	2908	LshO:exe	net.exe
PID 2732 wrote to memory of 2840	2732	59a6z0.exe	Yw3:exe
PID 2732 wrote to memory of 2840	2732	59a6z0.exe	Yw3:exe
PID 2732 wrote to memory of 2840	2732	59a6z0.exe	Yw3:exe
PID 2732 wrote to memory of 2840	2732	59a6z0.exe	Yw3:exe
PID 2908 wrote to memory of 2304	2908	LshO:exe	net.exe
PID 2908 wrote to memory of 2304	2908	LshO:exe	net.exe
PID 2908 wrote to memory of 2304	2908	LshO:exe	net.exe
PID 2908 wrote to memory of 2304	2908	LshO:exe	net.exe

C:\Users\Admin\AppData\Local\Yw3:exe
C:\Users\Admin\AppData\Local\Yw3:exe 3 C:\Users\Admin\AppData\Local\VvDMxU\59a6z0.exe
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2840

C:\Windows\SysWOW64\net.exe
C:\Windows\system32\net.exe view
1⤵
- Discovers systems in the same network
PID:2812

C:\Users\Admin\AppData\Local\VvDMxU\59a6z0.exe
C:\Users\Admin\AppData\Local\VvDMxU\59a6z0.exe 2
1⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2732

C:\Users\Admin\AppData\Local\LshO:exe
C:\Users\Admin\AppData\Local\LshO:exe 1 C:\Users\Admin\AppData\Local\Temp\0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\net.exe
C:\Windows\system32\net.exe view \\CALKHSYM
2⤵
- Discovers systems in the same network
PID:2304

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\VvDMxU\59a6z0.exe 2
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
"C:\Users\Admin\AppData\Local\Temp\0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2964

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\LshO:exe
Filesize
92KB

MD5
6c482e3d0fdc8af0182d543371ca5176

SHA1
e4de59423b77477cc593b7f31d08252107444524

SHA256
0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7

SHA512
ed217f7c2a0b0ca7716c0c04dc369598371d997590437f70ce68147276ef0cc8e3539306abcd5d16266dc5d4a6b984eab9e8fc5348dc2f6607ddea3eed4e0411

Download Submit
\Users\Admin\AppData\Local\LshO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2732-30-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2732-23-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2840-3258-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2840-14899-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2840-47087-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2908-182-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2964-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2964-1-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/2964-15-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads