c67452f65d0c7187312499a53670b1e82895518b487328026b2957ee77a274a1

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/PowerISO/packeg.exe
Size

5.0MB
MD5

725c335d5fd5305e5b5db2c84cf90abd
SHA1

36daa31b318051f5cf8b9038e46e977cd18af57e
SHA256

5e9274f4940ab3a90f48715c82149ab209ed4b585347c9a91fbe23534834e268
SHA512

f4962fcd3481380fca17f0cc7483f7dabc5c06488bd30acc836c8312e30c1a5195ddd98c00a5a132affc20d17575ec43b83e802f80d025b3891f67e5eb82ea53
SSDEEP

98304:gEjZ7eMAM5Aw3ZQtpy6GV5T6nn3F6xnCXWM1VCRTovs1xiKpp0qfcu8:LkVAAFsV5T63FC6VUovw1pCqfcf

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\0F7623F5.log	packeg.exe

Loads dropped DLL 3 IoCs

pid	Process
1924	packeg.exe
1924	packeg.exe
1924	packeg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	packeg.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	packeg.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	packeg.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	packeg.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	packeg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1924	packeg.exe
1924	packeg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	packeg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1924	packeg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1924	packeg.exe
1924	packeg.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\PowerISO\packeg.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\PowerISO\packeg.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd25940016230596\bootstrap_29975.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd25940016230596\css\main.css

Filesize
6KB

MD5
9b27e2a266fe15a3aabfe635c29e8923

SHA1
403afe68c7ee99698c0e8873ce1cd424b503c4c8

SHA256
166aa42bc5216c5791388847ae114ec0671a0d97b9952d14f29419b8be3fb23f

SHA512
4b07c11db91ce5750d81959c7b2c278ed41bb64c1d1aa29da87344c5177b8eb82d7d710b426f401b069fd05062395655d985ca031489544cdf9b72fe533afa61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd25940016230596\images\Loader.gif

Filesize
10KB

MD5
57ca1a2085d82f0574e3ef740b9a5ead

SHA1
2974f4bf37231205a256f2648189a461e74869c0

SHA256
476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e

SHA512
2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

Download Submit
\Users\Admin\AppData\Local\Temp\nst1641.tmp\Math.dll

Filesize
144KB

MD5
889e8fe8a034acb4d4a33349e34907a9

SHA1
e439458df040ec14002c67f0a863bb714a6241aa

SHA256
d9b253e80eca58d3e2c5882359b5aa3257bd0b4bec5d02a7874004466ef77c57

SHA512
a604e3f8c385af9b2f29e82fa411b220a71bc234521d1194de1a2a09cca567f31c33c887a1f69ffb33fb2db91519a99e84ef064d507af16646db6919dd712d94

Download Submit
\Users\Admin\AppData\Local\Temp\nst1641.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nst1641.tmp\qzoxzhphgp.dll

Filesize
1002KB

MD5
4bb0f84995346c5f73a3dfbd8d8cf26b

SHA1
17c011f920bd74c37c86488832fd95270429478b

SHA256
5f9e2a5ef08cd02bcac2d2045f7b149b11f4daed2a253bbcc38cdfe8b1850600

SHA512
bf9e042405df6af8eb54c78ee8fd0ac00b997171bf0a88ffb36588d2f9247667b9c03a73fc97b7e58e3ed8cf5c37e0fbe4f2033c1ebe78b91121c92adecf1369

Download Submit
memory/1924-278-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-285-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-17-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-255-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-259-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-260-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/1924-262-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-264-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-266-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-15-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-275-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-277-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-13-0x00000000041C0000-0x00000000042A5000-memory.dmp

Filesize
916KB

Download
memory/1924-276-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-12-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-16-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-9-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-286-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-294-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-7-0x0000000002710000-0x0000000002810000-memory.dmp

Filesize
1024KB

Download
memory/1924-300-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-301-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-302-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-303-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-304-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-305-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-306-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-307-0x0000000002710000-0x0000000002810000-memory.dmp

Filesize
1024KB

Download
memory/1924-308-0x00000000043B0000-0x00000000045BC000-memory.dmp

Filesize
2.0MB

Download
memory/1924-310-0x00000000041C0000-0x00000000042A5000-memory.dmp

Filesize
916KB

Download
memory/1924-311-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download