c67452f65d0c7187312499a53670b1e82895518b487328026b2957ee77a274a1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/PowerISO/packeg.exe
Size

5.0MB
MD5

725c335d5fd5305e5b5db2c84cf90abd
SHA1

36daa31b318051f5cf8b9038e46e977cd18af57e
SHA256

5e9274f4940ab3a90f48715c82149ab209ed4b585347c9a91fbe23534834e268
SHA512

f4962fcd3481380fca17f0cc7483f7dabc5c06488bd30acc836c8312e30c1a5195ddd98c00a5a132affc20d17575ec43b83e802f80d025b3891f67e5eb82ea53
SSDEEP

98304:gEjZ7eMAM5Aw3ZQtpy6GV5T6nn3F6xnCXWM1VCRTovs1xiKpp0qfcu8:LkVAAFsV5T63FC6VUovw1pCqfcf

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Drops file in Program Files directory 1 IoCs

Processes:

packeg.exe

description ioc process

File created C:\Program Files (x86)\0E579412.log packeg.exe
Loads dropped DLL 4 IoCs

Processes:

packeg.exe

pid process

2492 packeg.exe
2492 packeg.exe
2492 packeg.exe
2492 packeg.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Program Files (x86)\0E579412.log	packeg.exe

pid	process
2492	packeg.exe
2492	packeg.exe
2492	packeg.exe
2492	packeg.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

packeg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	packeg.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	packeg.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

packeg.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS packeg.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

packeg.exe

pid process

2492 packeg.exe
2492 packeg.exe
2492 packeg.exe
2492 packeg.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

packeg.exe

description pid process

Token: SeShutdownPrivilege 2492 packeg.exe
Token: SeCreatePagefilePrivilege 2492 packeg.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

packeg.exe

pid process

2492 packeg.exe
2492 packeg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	packeg.exe

pid	process
2492	packeg.exe
2492	packeg.exe
2492	packeg.exe
2492	packeg.exe

description	pid	process
Token: SeShutdownPrivilege	2492	packeg.exe
Token: SeCreatePagefilePrivilege	2492	packeg.exe

pid	process
2492	packeg.exe
2492	packeg.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\PowerISO\packeg.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\PowerISO\packeg.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2492

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd24061945346198\bootstrap_37417.html
Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd24061945346198\css\main.css
Filesize
6KB

MD5
9b27e2a266fe15a3aabfe635c29e8923

SHA1
403afe68c7ee99698c0e8873ce1cd424b503c4c8

SHA256
166aa42bc5216c5791388847ae114ec0671a0d97b9952d14f29419b8be3fb23f

SHA512
4b07c11db91ce5750d81959c7b2c278ed41bb64c1d1aa29da87344c5177b8eb82d7d710b426f401b069fd05062395655d985ca031489544cdf9b72fe533afa61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd24061945346198\images\Loader.gif
Filesize
10KB

MD5
57ca1a2085d82f0574e3ef740b9a5ead

SHA1
2974f4bf37231205a256f2648189a461e74869c0

SHA256
476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e

SHA512
2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\Math.dll
Filesize
144KB

MD5
889e8fe8a034acb4d4a33349e34907a9

SHA1
e439458df040ec14002c67f0a863bb714a6241aa

SHA256
d9b253e80eca58d3e2c5882359b5aa3257bd0b4bec5d02a7874004466ef77c57

SHA512
a604e3f8c385af9b2f29e82fa411b220a71bc234521d1194de1a2a09cca567f31c33c887a1f69ffb33fb2db91519a99e84ef064d507af16646db6919dd712d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\System.dll
Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\qzoxzhphgp.dll
Filesize
1002KB

MD5
4bb0f84995346c5f73a3dfbd8d8cf26b

SHA1
17c011f920bd74c37c86488832fd95270429478b

SHA256
5f9e2a5ef08cd02bcac2d2045f7b149b11f4daed2a253bbcc38cdfe8b1850600

SHA512
bf9e042405df6af8eb54c78ee8fd0ac00b997171bf0a88ffb36588d2f9247667b9c03a73fc97b7e58e3ed8cf5c37e0fbe4f2033c1ebe78b91121c92adecf1369

Download Submit
memory/2492-269-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-285-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-20-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-258-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-262-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-263-0x0000000004080000-0x0000000004081000-memory.dmp

Filesize
4KB

Download
memory/2492-265-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-267-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-17-0x0000000003A10000-0x0000000003AF5000-memory.dmp

Filesize
916KB

Download
memory/2492-271-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-273-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-18-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-15-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-19-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-287-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-288-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-12-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-9-0x00000000030B0000-0x00000000031B0000-memory.dmp

Filesize
1024KB

Download
memory/2492-299-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-301-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-303-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-305-0x0000000003C00000-0x0000000003E0C000-memory.dmp

Filesize
2.0MB

Download
memory/2492-306-0x00000000030B0000-0x00000000031B0000-memory.dmp

Filesize
1024KB

Download
memory/2492-308-0x0000000003A10000-0x0000000003AF5000-memory.dmp

Filesize
916KB

Download
memory/2492-309-0x0000000004080000-0x0000000004081000-memory.dmp

Filesize
4KB

Download