Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
08/01/2024, 19:14
General
-
Target
4c3d5dd953255007212e1539a679a35b.exe
-
Size
282KB
-
MD5
4c3d5dd953255007212e1539a679a35b
-
SHA1
63998aef1366dfeee4b4feeaa03f61cd26c6ef63
-
SHA256
97c53a4102426095a2b6e26c3afc8dbeed0d51d0118292f50cd36ede55f791a8
-
SHA512
644d60192d9dc5c919051a1e0566778aa42fb0616ae09115ef51b93a152dd1f104aeeb93c9ea3db5eec207237882f2f57123e6f97f9c7ff3bf815625216ef604
-
SSDEEP
6144:crPrHEYF57R69Um+nEY0kqk4PXzCPamiHtRNCI6X:2HXF9R6ym+skK07mKX
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c3d5dd953255007212e1539a679a35b.exe"C:\Users\Admin\AppData\Local\Temp\4c3d5dd953255007212e1539a679a35b.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\4c3d5dd953255007212e1539a679a35b.exeC:\Users\Admin\AppData\Local\Temp\4c3d5dd953255007212e1539a679a35b.exe startC:\Users\Admin\AppData\Roaming\008B6\CBEAF.exe%C:\Users\Admin\AppData\Roaming\008B62⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4c3d5dd953255007212e1539a679a35b.exeC:\Users\Admin\AppData\Local\Temp\4c3d5dd953255007212e1539a679a35b.exe startC:\Program Files (x86)\B6482\lvvm.exe%C:\Program Files (x86)\B64822⤵
-
-
C:\Program Files (x86)\LP\AFA0\D72D.tmp"C:\Program Files (x86)\LP\AFA0\D72D.tmp"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300B
MD51bdccb554f63da04557f163864f70a75
SHA18c5df69f4a784c38377e661231768543af146c0d
SHA256a3bbd3fc96252b665485bbbc459b6e8bc9d209893a2675eb0b0281f5e0a0790c
SHA512dceee0641a86521ceda367437d8f1f5c66091253c7257c1a242b9ab5094eb6862b6a289d507680fd5e30f45a5ed806b868c2f7ab53eadc2d43567c3c08483019
-
Filesize
1KB
MD5b5cedfe72fb7a049bff33d0094a064a1
SHA1c1e8bb4d67a830d5167f9c6e7ed3357ef2b10698
SHA25617fccc51278c8a0ef5f11e2163c7cd8e1fdd3c382f8a71cad16c41a6d3c74b3c
SHA51295e632d219b12a28645be24e31de5a14906a109e5edd506b18cf4971a4a771f7929ee928df4671649d0782feb4006c3f2d7f26b80766a2cf685f3acc74776859
-
Filesize
600B
MD58ae470712a1aae19f426d63730ca341e
SHA11ee498cd3966ee94ce711c7b16e44a50b7a7fd48
SHA2562e58d4794c879669222ec80f19d845880317886acc2598e8faf9af9a8cee53c4
SHA51269f9f52f182d4b40fcb947808b0334f5fbe524c917af5ede29d4c4126733feb02d7d2cd6eceb529de6dc01d027a44ae9ea87f6b08983dc51a278beb16b2513b5
-
Filesize
996B
MD57d11b3a5e8447a1331ba3ca2a84865e2
SHA160dadf5557314aba66197d4352f057c0a84e0407
SHA256247b95fc12b0c06db1a99485d6734ca6c2f78f075d08e5100dc108972648bb82
SHA5127e443b7f1f7bf4b9b84da033d978a04c64a53185834fdb703f2bd1251273c282d4bde408d355dc153faf3cf190604ed268d0eba5a03ea60d0a8db48cfae337bf
-
Filesize
99KB
MD59d83b6d4629b9d0e96bbdb171b0dc5db
SHA1e9bed14c44fe554e0e8385096bbacca494da30b1
SHA256d3a6060ff059a7724a483d82025a9231a61143839b633a6d3842a58ccb5a7d7d
SHA512301187bdcab5ca9942b2c7b7114e37e53e58b5661eef50c389622950d7691993a29f5a825132cf499ca73cdb6637d3f58afdc024cb04fac2b8e01f752209572c
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
1024KB
-
Filesize
432KB
-
Filesize
1024KB
-
Filesize
432KB
-
Filesize
284KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
284KB
-
Filesize
432KB
-
Filesize
112KB
-
Filesize
1024KB
-
Filesize
112KB