95e217da4c184170c705e9ef317b5d8333713f4f91435d0964e0e2cea03100ab

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Size

2.3MB
MD5

d9615368a7ba5bb0c15e398f4097dc1f
SHA1

bc747bc86fed777358b2c71a8ea95f7ccbf3e5a4
SHA256

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3
SHA512

1b592a7a2034f881b86e7103c4fde9aed0a2095ee6e28bc61a7ff454c9ae0716a95b43785497a627e3cc66cccb6b338f4e832acdd69b0fdddb2c88f05aa73cd3
SSDEEP

49152:xTs9zpYo556eURBCDd/BP1+zX3ympAGBnEl6U8/j/SIGzgnUjQ58IkUC4:x49SoqrRBClh1+znnBd77lPO

Score

9^/10

collection discovery evasion persistence spyware stealer

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ipinfo.io
3 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

pid process

1760 01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

flow	ioc
4	ipinfo.io
3	ipinfo.io

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

580 schtasks.exe
2404 schtasks.exe

pid	process
580	schtasks.exe
2404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

pid	process
1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	pid	process	target process
PID 1760 wrote to memory of 580	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 580	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 580	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 580	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 2404	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 2404	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 2404	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe
PID 1760 wrote to memory of 2404	1760	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe	schtasks.exe

outlook_office_path 1 IoCs

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

outlook_win_path 1 IoCs

Processes:

01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe

C:\Users\Admin\AppData\Local\Temp\01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
"C:\Users\Admin\AppData\Local\Temp\01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1760

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:580

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:2404

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\spanWUBZsgEEOYAI\f9W74x_MwcGEWeb Data
Filesize
92KB

MD5
2157696941ae13875f8dfe8630ea4029

SHA1
b5ff62b7900cdfc630edd94d737309042de58251

SHA256
90e438a9d6706c8a1e809bfb5babe83508cac27d3c9f3f9b8bd1cd4f3aa3e033

SHA512
61b998e42f5d0121f75e04a46177c1c3a7122dc2014b7bed1d584c9ea53146e87d7a6b9e94bde066d92580c6c2b2316dd860980e5cd8f75984286dc90e43fb6a

Download Submit
memory/1760-20-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/1760-2-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/1760-17-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-0-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-7-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1760-11-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/1760-13-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/1760-12-0x00000000009F0000-0x00000000009F2000-memory.dmp

Filesize
8KB

Download
memory/1760-9-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/1760-10-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/1760-14-0x0000000002D30000-0x0000000002D32000-memory.dmp

Filesize
8KB

Download
memory/1760-8-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/1760-6-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/1760-5-0x00000000010B0000-0x00000000010B1000-memory.dmp

Filesize
4KB

Download
memory/1760-15-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-16-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-3-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/1760-21-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Filesize
4KB

Download
memory/1760-4-0x00000000010A0000-0x00000000010A1000-memory.dmp

Filesize
4KB

Download
memory/1760-19-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/1760-18-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/1760-22-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/1760-23-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/1760-26-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/1760-27-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/1760-30-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download
memory/1760-29-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/1760-31-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-32-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download
memory/1760-33-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/1760-34-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/1760-35-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/1760-1-0x0000000077B80000-0x0000000077B82000-memory.dmp

Filesize
8KB

Download
memory/1760-73-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/1760-72-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/1760-81-0x0000000001330000-0x0000000001907000-memory.dmp

Filesize
5.8MB

Download