Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
31/05/2024, 07:45
General
-
Target
ORDER CONFIRMATIONS MAIN STORE USP-PO-2403103 USP-PR-2024.scr.exe
-
Size
1.2MB
-
MD5
65381bc5947270a4cd95fc31359c70f3
-
SHA1
c9d54bf3730a72f5fa7ab92659ea1874d539297e
-
SHA256
9681f60064bcf9cb185d49d8fc355fa75daef418188f0a20db66a96884f14733
-
SHA512
064d6c12c3123db1c2617ef2f19cbd48a9e52e232b67b9fb992d00c1a056b3ca2030a45e63cd4b49dc4075c8351f1cada740c4c622186fed172aa5cb73b26820
-
SSDEEP
24576:nOdyJRGkkkHmk1538alCRmlCqyKDZae6ts91hO2ak2yrF+BOtu:nSyH9kEmkP35C0lCqFo5S/aklJ+ot
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER CONFIRMATIONS MAIN STORE USP-PO-2403103 USP-PR-2024.scr.exe"C:\Users\Admin\AppData\Local\Temp\ORDER CONFIRMATIONS MAIN STORE USP-PO-2403103 USP-PR-2024.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ORDER CONFIRMATIONS MAIN STORE USP-PO-2403103 USP-PR-2024.scr.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gOgYYSaHwal.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gOgYYSaHwal" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7446.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\ORDER CONFIRMATIONS MAIN STORE USP-PO-2403103 USP-PR-2024.scr.exe"C:\Users\Admin\AppData\Local\Temp\ORDER CONFIRMATIONS MAIN STORE USP-PO-2403103 USP-PR-2024.scr.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
1KB
MD529d4a7ea692f77df888a6bd98d657488
SHA121ac98900c71f10ad933e16f26ae9c0adf5dce4a
SHA256d82aba0a5fc84e9b0d8fca237d16ba36740c4eac4bd2c96374af72cf82164287
SHA512fad49c6b55e0cae22241880f36ff9b2f8dc218a925b04b1531ce36025bb20efe4ac7413d3d66aad83ce82762b6a589c56d8bef656fae9cbf158e9c3858d12cae
-
Filesize
7KB
MD54a72a6a2f1b2c8c94eb164fa61b2478a
SHA13e1ecb1c6f8ad15caab23b128bf6f73899169135
SHA2562a948ec9d71f562fd2f7fa5ea87bf968df2c3fd929def9681cd188142f57ddb0
SHA5129e88029586ce469e1a7cbd71cecf3beee4d28d1b1d7d836a76f6d221089a40ca63512c0b544d959890b53a7102d2f0b70c1a1b35bc208e26f8af0f6e891db8d6
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
6.9MB
-
Filesize
80KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
4KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
304KB
-
Filesize
632KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
176KB
-
Filesize
488KB