Overview

overview

10

Static

static

3

4b88965543...c1.exe

windows7-x64

10

4b88965543...c1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01/01/2024, 20:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4b8896554332d025010afb7c2d634ae9ff5294433f534652aa1cf0cf2a0b1ac1.exe

  • Size

    2.5MB

  • MD5

    39dd164fd6cf3c0c7ffc63a654c01a8d

  • SHA1

    ef36ccb87b338c94e67a6c7c4a5293e7222436af

  • SHA256

    4b8896554332d025010afb7c2d634ae9ff5294433f534652aa1cf0cf2a0b1ac1

  • SHA512

    373ff3350b876ed9691ef1c8e920eb4b18ba887de8e8028899b9d294a055148810d2d368b57ff623aedd17605ddb8295a089641ac3a0431c02e282cfbb152412

  • SSDEEP

    49152:1TjxpDC2v28vf+yGNbnIzLNckkmTmAl6xBaUmUUshTsdfIl+nMXf5H:xPCL6fpGNDQRc6T8VRx8nMP5H

Score
10/10
googlecollectiondiscoveryevasionpersistencephishingspywarestealertrojan

Malware Config

Signatures

  • Detected google phishing page
    phishinggoogle
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
    evasiontrojan
  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b8896554332d025010afb7c2d634ae9ff5294433f534652aa1cf0cf2a0b1ac1.exe
    "C:\Users\Admin\AppData\Local\Temp\4b8896554332d025010afb7c2d634ae9ff5294433f534652aa1cf0cf2a0b1ac1.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YV3li16.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YV3li16.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rJ6nY27.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rJ6nY27.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2756
  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:1204
  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:356
  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:1988
  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Hq1WH4.exe
    C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Hq1WH4.exe
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Drops startup file
    • Executes dropped EXE
    • Loads dropped DLL
    • Windows security modification
    • Accesses Microsoft Outlook profiles
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • outlook_office_path
    • outlook_win_path
    PID:2636
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2544
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      2⤵
        PID:1552
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
        2⤵
          PID:964
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 2420
          2⤵
          • Loads dropped DLL
          • Program crash
          PID:2464
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2744
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" https://facebook.com/login
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2868
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2724
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
        1⤵
        • Creates scheduled task(s)
        PID:1996
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
        1⤵
        • Creates scheduled task(s)
        PID:2304
      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2vK7960.exe
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2vK7960.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2716

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Scheduled Task/Job

      1
      T1053

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Scheduled Task/Job

      1
      T1053

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Scheduled Task/Job

      1
      T1053

      Defense Evasion

      Impair Defenses

      2
      T1562

      Disable or Modify Tools

      2
      T1562.001

      Modify Registry

      5
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Credential Access

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Email Collection

      1
      T1114

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YV3li16.exe
        Filesize

        321KB

        MD5

        6279dc967f093ec05e3f43d2581f8e9b

        SHA1

        dc9d4c123e94a28f4f857b8e3a0f7be3abb604f3

        SHA256

        5a5d40d6fdac8958aa3ef175d19f3dec9a7d7bf9c39b38a9f8d56267df53606d

        SHA512

        c3de828e6964d049177c2131f41c4ca3488b35da1ed536db8113955d19f45fcdf2d1ee82adaf470e492f4daa01f4be8e21079713c5a84c13d1fad80043bca050

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YV3li16.exe
        Filesize

        385KB

        MD5

        5589871c0ac0833afdb4390c75dd1b9a

        SHA1

        ef1f2ff8502e8ec0cea6b42f2abf64f1c01045d6

        SHA256

        f2ec65f8df8a1a0c77fba0a1369a3721f70fab041412f1d36606a10db1372a36

        SHA512

        30fdb7168e51dff83c9ff2cbfb1b8bec80842b9535dd6f393de0df39c324d2f1def13090bdaded47440592a6ff305ab354146e580950bd2d9bb9be16fdd5bb39

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rJ6nY27.exe
        Filesize

        1.4MB

        MD5

        a8a69a7c47472b9ea70e3623f098a8b3

        SHA1

        4c78be82b30c1a95a4a452358495d3f28d601ac1

        SHA256

        8e976f19b628e6f5a8aa4cd494031484d9a821eee3ac37b327fb7740124d9de4

        SHA512

        679362a79927753d2e1b6ebf05f4c98a315e7158ef725408bcfb93161ac6ecd0485cd877d3dd2d165f5aa3d46ba0b0743e590974898bb50d105b48cedab66467

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rJ6nY27.exe
        Filesize

        1.4MB

        MD5

        811f3b2e720a8cbd15d8656920a97c6a

        SHA1

        2abaa1926965b5f6784e3fbcd54b9712244f8782

        SHA256

        6e876b96d39010fa6827062c090700cd796a77c5e427922608105cca9c751b7b

        SHA512

        bc2e3b3baf939881665c4fc5f91dd1322f4328cf00bb540d910c1deba4478a82d088fb237d0c4af801f2dfdeb8ae216f0064be83a76465675f23c164f6ba0ecc

        Download Submit

      • \Users\Admin\AppData\Local\Temp\IXP000.TMP\YV3li16.exe
        Filesize

        1024KB

        MD5

        4d5136be4bd2696f9e789cc17bfb0bca

        SHA1

        d7282c780605f1946c0e6e14c505fe5fba563c5c

        SHA256

        0429911d3978dac894dce34d537b34e08d448a359a8c31378f8178379b4b0a4b

        SHA512

        141e761244ed2e19b5cfe6a9fde72b007b75feb8f63f99282c04e0eb8f2b2960422bf9828875a137576761e7ff0392948320d9cc7e80929a9866270176e0288d

        Download Submit

      • \Users\Admin\AppData\Local\Temp\IXP000.TMP\YV3li16.exe
        Filesize

        377KB

        MD5

        2ce861e210af85a2e3d07f0ea9967552

        SHA1

        7c09d98a4143706544df5d61ccbb36a415666643

        SHA256

        9bd748aa7062d6cde2b8d30bc194b0e54c308712c26fe34e3740334f6ddddd0d

        SHA512

        17b9b0501b3c92b24547355915f54db8f8387411d5268979d7a58ae86be7a92aa80b95b36d2ff8ca01bc7bf656eb9170f9db987b7948aea97369545983b242ba

        Download Submit

      • \Users\Admin\AppData\Local\Temp\IXP001.TMP\rJ6nY27.exe
        Filesize

        92KB

        MD5

        3774b826e7e33990cbf7aaae2188e825

        SHA1

        faa58be407053658ab97755e8922c69a371ad6cc

        SHA256

        2a4772bebb753ba61d49bebcb8caf0d4e390b660bb95000e59fd00004d93d2b9

        SHA512

        1f6ebd221264f1f8cb22a3e772b5975d30180f6f788e4d8f4f2f387dae7d7eec9ecf1e1ac901096a2026e8d324807654dc7494aee5cd69ca241fc0359e99f6be

        Download Submit

      • memory/2544-102-0x000000006D820000-0x000000006DDCB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2544-115-0x000000006D820000-0x000000006DDCB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2544-103-0x0000000002860000-0x00000000028A0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/2636-37-0x00000000011D0000-0x000000000162E000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2636-124-0x00000000007C0000-0x00000000007D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2636-42-0x0000000000B90000-0x0000000000FEE000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2636-38-0x0000000000B90000-0x0000000000FEE000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2636-257-0x0000000000B90000-0x0000000000FEE000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2636-584-0x00000000011D0000-0x000000000162E000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2636-659-0x0000000000B90000-0x0000000000FEE000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2636-761-0x0000000000B90000-0x0000000000FEE000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2636-843-0x0000000000B90000-0x0000000000FEE000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2756-36-0x0000000002990000-0x0000000002DEE000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2756-308-0x0000000002990000-0x0000000002DEE000-memory.dmp

        Filesize

        4.4MB

        Download