Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-03-2024 02:50
General
-
Target
dd0e73a123f1dc8e2fb436cb240351bb.exe
-
Size
277KB
-
MD5
dd0e73a123f1dc8e2fb436cb240351bb
-
SHA1
a3db66fc6944045a9639a253bbbf425367e72437
-
SHA256
53a24bad1cdca920f35b076ef3749f9b50278fed2aa406eb37a2eb3370361daf
-
SHA512
25fc82b16583ce0777ba881def1261612f47510f4f94bf80e6f676b200a309b9b31fcf08a1a3f3b5d701b6c1130114b7c50094bf0d68bd779e5573c520dbaf7e
-
SSDEEP
6144:jlYCgzpVQBuBXxezCDWelxli397ztXMkK0a:TgzpVQoeIi3RJMkK0a
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exe"C:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exeC:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exe startC:\Users\Admin\AppData\Roaming\7DCD4\38ED3.exe%C:\Users\Admin\AppData\Roaming\7DCD42⤵
-
C:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exeC:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exe startC:\Program Files (x86)\D4EC8\lvvm.exe%C:\Program Files (x86)\D4EC82⤵
-
C:\Program Files (x86)\LP\D3A7\870B.tmp"C:\Program Files (x86)\LP\D3A7\870B.tmp"2⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\7DCD4\4EC8.DCDFilesize
1KB
MD5cadfcd07ae828d314482df59968b3b3d
SHA1084d002c2375573a6a15af136ac6c4728f35731f
SHA256f646aa3aceb92294de33e9d0ae6915aaf453440d55777e44dc1a6330a8164525
SHA512ecd564b00e853d6cadbd8aab59533726aca7c24db62ae58776cba45e0d44333e2020afc07e45d0075493828f9d48e5135769bef209330344e5ac97ef61d5032e
-
C:\Users\Admin\AppData\Roaming\7DCD4\4EC8.DCDFilesize
1KB
MD5b9a1e43e2e7a5b08991668e136b3b2af
SHA126381124747764eaef62044087c47ca30a63261d
SHA256da44bdeec2b20b50c2811269229d47bddd0d3d412ccf7b8c564be3eea091d301
SHA512303e185087e9f758227be810537f606899af58f16f76a1ed29405bef1e3447d803cd6aea96fd8348d02bb12bf93d4c4a999b41f019d80a3f9dffdd4c3d16372f
-
C:\Users\Admin\AppData\Roaming\7DCD4\4EC8.DCDFilesize
600B
MD5ae8e2f493866de9ed17609d6009f73c7
SHA12379e309992ad4554a32669b40ad873279d8dd87
SHA256816c94e7f21b5dde707010f348442fdd869ab8596781b62a797fedbe27ffd1e2
SHA51287322e01d07783b11e0faba92d2e44b928b9974a3a89857c1b3aae74dcd32c954c13b896b58d8c362fd1ce4947a22e8b4e59c8d320780fb9a39b9fd01134c451
-
\Program Files (x86)\LP\D3A7\870B.tmpFilesize
98KB
MD5d80b9b537e9352a07cf0832971882498
SHA14f3c79ad91344b644ed160b843946712c9201282
SHA2562a6fa00fea45fa4c2947c1da516f8dbdc3b5c53b30e9d4f1b988edf254ddfa99
SHA5127c0f43ac9ae5d03784ce7968a935c891d255d6b6f601d1ee0b16c1f01e7b18926bb7d8b772a85eb58b9ac4331c73f241bc94c8293a9a12d81ba4bebe05e46190
-
memory/288-193-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/288-105-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/288-106-0x00000000004D0000-0x00000000005D0000-memory.dmpFilesize
1024KB
-
memory/536-195-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/536-87-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/536-86-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/536-88-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/1108-192-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/1108-198-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/2116-12-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2116-13-0x0000000000568000-0x00000000005AD000-memory.dmpFilesize
276KB
-
memory/2880-104-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2880-1-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2880-14-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2880-194-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2880-85-0x0000000000580000-0x0000000000680000-memory.dmpFilesize
1024KB
-
memory/2880-2-0x0000000000580000-0x0000000000680000-memory.dmpFilesize
1024KB