Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19/01/2024, 07:51
General
-
Target
67151d9ea72c4c724999770fe50fd8a2.exe
-
Size
279KB
-
MD5
67151d9ea72c4c724999770fe50fd8a2
-
SHA1
2c8d5fe18b109a01573a832213fc618dd97abd53
-
SHA256
db6c4c31aec91d55efb9174c4acf54bf7229741ead64c8e2e29c94611d91e47c
-
SHA512
b7413eaeff0fddadca1ec285d7fe8c2ee014502dcfb60a58d1928b38988da21de336daefe109031a7f24d7a92448c714ff165e3adf31bc08198d75ac061a738b
-
SSDEEP
6144:yhX0YplXTnIJQ19PRVmP3sVsmYl1Im9v4PY7ecUWJggKy2Komw2Uk6i:Y0YpusPRzsz9qPUPJgX9CUkh
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\67151d9ea72c4c724999770fe50fd8a2.exe"C:\Users\Admin\AppData\Local\Temp\67151d9ea72c4c724999770fe50fd8a2.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\67151d9ea72c4c724999770fe50fd8a2.exeC:\Users\Admin\AppData\Local\Temp\67151d9ea72c4c724999770fe50fd8a2.exe startC:\Users\Admin\AppData\Roaming\9AB74\627A7.exe%C:\Users\Admin\AppData\Roaming\9AB742⤵
-
-
C:\Users\Admin\AppData\Local\Temp\67151d9ea72c4c724999770fe50fd8a2.exeC:\Users\Admin\AppData\Local\Temp\67151d9ea72c4c724999770fe50fd8a2.exe startC:\Program Files (x86)\74D6E\lvvm.exe%C:\Program Files (x86)\74D6E2⤵
-
-
C:\Program Files (x86)\LP\A779\9176.tmp"C:\Program Files (x86)\LP\A779\9176.tmp"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD59eabdd0160aa46c3d8551ef703eb9664
SHA1d87cae76621bf28903cf0636f88e8165176383b5
SHA25601ae31b1e56b2de04132cb9d233a246d6c12184d8938f82cadbf9f9e3d3d7c17
SHA5122cc7b0f55b4c31e23adf41bf9b5f0067351a26c097f83a68b0c55f086770528dc89102896f7c83a89f507f882977dd3b9b8b982c165b151246117f1646cbe148
-
Filesize
1KB
MD58b8313afba762daa21b2563104b29cb8
SHA16c9172db5cdb1346b1180e4dee21c6c11804cb6d
SHA256564bdeeffbacc4aba1a770fa9ef97caacf51fbbd06d20ff32dbf6fd57cf46f93
SHA51247435d868f6b4a94d83c232ce5e0c24cfe2109a49c9554d8c1b94d60ac4bedfa506aec395da0c3c21a596d7ce1c8c415ed83ac130343948e8f42355e632b704f
-
Filesize
600B
MD5b3476c5a1321b4044d0cc0adee439e5e
SHA149e6d111c414cfc709dff240e406e521960c95f1
SHA256b7e3056132eb17e96ebdd58a4b5d0f3473cd96fef4ddf43ea3ddddb08cb95db3
SHA512ff76f563047cf83e66be8316c94004facbbb6eae16fa573d0379be5538e3bfd40e9fa0f830a6d435feee54993a6b18c797a8631f35e8a1a368da0ecfa713181a
-
Filesize
100KB
MD5e58302bb7fff8ff38398a39d41d01138
SHA178af95fb145130591e8042b1c2fc55de5d400f29
SHA25604b45c5c0a776c46ee2caff5ea392d4ec4b6df2856d60ff70fa14b160bab8b29
SHA51245b5dd2041ce9ba158445ad7104570e37645b6b93914cba49accc655eff364ec01aff9f24e1059dad4be642ea8f57bc7d64a8cd50f2289d3d85fe81c56f40654
-
Filesize
112KB
-
Filesize
1024KB
-
Filesize
112KB
-
Filesize
284KB
-
Filesize
428KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB