Analysis

  • max time kernel
    166s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:38

General

  • Target

    a72d5fc2211db435af9ab375f832b3cd.exe

  • Size

    679KB

  • MD5

    a72d5fc2211db435af9ab375f832b3cd

  • SHA1

    7314bc8001f4aa904384a198e1df75660b3a5f63

  • SHA256

    8eef68e38ffd16167815c1e257779bd65af3accec82cd840905241c197ddcc2c

  • SHA512

    750ec66c04916748bdd99455d8507287b4da50949bc5677faadc2f72408a293a0f400a2bf97244693b7955e5afd7d915a5762733fe1432969943c41f3b393cb3

  • SSDEEP

    12288:o1P8JUFCBlF32PyN724Ck6TpxGbj8lleYIagaO:o1kJUFCBl52Pe724XSlzIagaO

Malware Config

Signatures

  • Nirsoft 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a72d5fc2211db435af9ab375f832b3cd.exe
    "C:\Users\Admin\AppData\Local\Temp\a72d5fc2211db435af9ab375f832b3cd.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Local\Temp\WebBrowserPassView.exe
      C:\Users\Admin\AppData\Local\Temp\WebBrowserPassView.exe /stext C:\Users\Admin\AppData\Local\Temp\Opera.txt
      2⤵
      • Executes dropped EXE
      PID:2688
    • C:\Users\Admin\AppData\Local\Temp\ProduKey.exe
      C:\Users\Admin\AppData\Local\Temp\ProduKey.exe /stext C:\Users\Admin\AppData\Local\Temp\ProduKey.txt
      2⤵
      • Executes dropped EXE
      PID:2244
    • C:\Users\Admin\AppData\Local\Temp\mspass.exe
      C:\Users\Admin\AppData\Local\Temp\mspass.exe /stext C:\Users\Admin\AppData\Local\Temp\MS.txt
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2580
    • C:\Users\Admin\AppData\Local\Temp\MC.exe
      C:\Users\Admin\AppData\Local\Temp\MC.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1648
  • C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\F8A1.tmp\TestLunch.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:684
    • C:\Windows\system32\java.exe
      java -jar "test.jar"
      2⤵
        PID:564

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Opera.txt

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Users\Admin\AppData\Local\Temp\ProduKey.txt

            Filesize

            1KB

            MD5

            280d0cbfe3a26c806d64da5440a96b42

            SHA1

            a22bd38174c75b3a1c7a0b8492c7f4cdbbcd1d83

            SHA256

            414ffaf22c19613483164f5b28e5d62816b5321cea6c25dfc32d4074e2b788eb

            SHA512

            09540ab38fd7a69c83dc839896e71f2d0637b31a2ddfe05b0a519fc1669dec186fe5535ebffc8668c6082a6ebb4be85fe862c432eba8d3c81c57bf959ec1b9c8

          • \Users\Admin\AppData\Local\Temp\ProduKey.exe

            Filesize

            37KB

            MD5

            12507d0c4b2963ba229e02ff961ec400

            SHA1

            6a9b296e5b614457f106cfc8ed6fc24bd75ba9aa

            SHA256

            bbcb52b0538c81d9ced034e2c0435188bcd1d36f09bce76654f494e4d5dcdb0c

            SHA512

            1ad84dc8f90fd2342f4136d7594a0e10ea6ceefa0fd1b64a96a9200af260f76e3be22e1e3d6577c8b6b9a4ac655d0a8e2e2615f52114e1b11fd0773ec4e2bf10

          • \Users\Admin\AppData\Local\Temp\mspass.exe

            Filesize

            65KB

            MD5

            ffc52f2b4435fcddaca6e15489a88b75

            SHA1

            63ec31a04cf176852344d544ae855da0dac64980

            SHA256

            3f3c8484962b395f304a836ee5e8ee17beaafe982795c9747d8ee98cc6e4ca8f

            SHA512

            389694feccfe6ca352705b9481913fece6d1d47083f235ccdd60c05cfda82606be53845fde0dba8ec3f3748f820a828c9be0ce078c8b9cc853285b23f172841c

          • memory/564-94-0x0000000000130000-0x0000000000131000-memory.dmp

            Filesize

            4KB

          • memory/564-104-0x0000000002100000-0x0000000005100000-memory.dmp

            Filesize

            48.0MB

          • memory/564-92-0x0000000002100000-0x0000000005100000-memory.dmp

            Filesize

            48.0MB

          • memory/1648-95-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/1648-64-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/2244-39-0x0000000000400000-0x0000000000418000-memory.dmp

            Filesize

            96KB

          • memory/2244-43-0x0000000000400000-0x0000000000418000-memory.dmp

            Filesize

            96KB

          • memory/2580-23-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/2580-25-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/2668-65-0x00000000009B0000-0x00000000009C8000-memory.dmp

            Filesize

            96KB

          • memory/2668-40-0x00000000749D0000-0x0000000074F7B000-memory.dmp

            Filesize

            5.7MB

          • memory/2668-46-0x00000000749D0000-0x0000000074F7B000-memory.dmp

            Filesize

            5.7MB

          • memory/2668-49-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-48-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-32-0x00000000009B0000-0x00000000009C8000-memory.dmp

            Filesize

            96KB

          • memory/2668-45-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-22-0x00000000009B0000-0x00000000009D6000-memory.dmp

            Filesize

            152KB

          • memory/2668-50-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-0-0x00000000749D0000-0x0000000074F7B000-memory.dmp

            Filesize

            5.7MB

          • memory/2668-38-0x00000000009B0000-0x00000000009C8000-memory.dmp

            Filesize

            96KB

          • memory/2668-63-0x00000000009B0000-0x00000000009D6000-memory.dmp

            Filesize

            152KB

          • memory/2668-62-0x0000000001150000-0x0000000001167000-memory.dmp

            Filesize

            92KB

          • memory/2668-60-0x00000000009B0000-0x00000000009D6000-memory.dmp

            Filesize

            152KB

          • memory/2668-55-0x0000000001150000-0x0000000001167000-memory.dmp

            Filesize

            92KB

          • memory/2668-47-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-24-0x00000000009B0000-0x00000000009D6000-memory.dmp

            Filesize

            152KB

          • memory/2668-2-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-96-0x00000000009B0000-0x00000000009C8000-memory.dmp

            Filesize

            96KB

          • memory/2668-98-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-99-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-100-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-101-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-102-0x0000000001150000-0x0000000001167000-memory.dmp

            Filesize

            92KB

          • memory/2668-103-0x0000000001150000-0x0000000001167000-memory.dmp

            Filesize

            92KB

          • memory/2668-1-0x00000000749D0000-0x0000000074F7B000-memory.dmp

            Filesize

            5.7MB

          • memory/2668-107-0x0000000007DB0000-0x0000000007EB0000-memory.dmp

            Filesize

            1024KB

          • memory/2668-117-0x0000000007DB0000-0x0000000007EB0000-memory.dmp

            Filesize

            1024KB

          • memory/2668-123-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-124-0x00000000000F0000-0x0000000000130000-memory.dmp

            Filesize

            256KB

          • memory/2668-129-0x0000000001150000-0x0000000001153000-memory.dmp

            Filesize

            12KB

          • memory/2668-128-0x00000000749D0000-0x0000000074F7B000-memory.dmp

            Filesize

            5.7MB