f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf

General

Target

f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
Size

220KB
MD5

6d85ebcbc32c933cb5d8249cf1c333e0
SHA1

47f50f2395caf7b01b9cd3832f0136e8c31afbe0
SHA256

f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf
SHA512

fbc70753f623b80f0d96182059892c0254f1ffdb8d171e2104d9e91bf23bb2342f52b3e4ae2b40b9a0f087302aaf23a8805101411f49881ed1a03ca00ea325d2
SSDEEP

6144:A//ICMmDRxs3NBR7Edysbp7VY7XcagUsYLoMow:A//vi9B1EpaIusYLo0

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\S:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\U:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\V:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\A:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\G:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\I:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\M:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\O:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\R:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\W:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\Y:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\J:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\K:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\L:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\P:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\T:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\X:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\E:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\H:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\N:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\Q:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File opened (read-only)	\??\Z:	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\beast xxx [free] circumcision .mpeg.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files (x86)\Google\Temp\spanish horse animal public nipples (Ashley).mpg.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\german porn horse several models legs .avi.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files\Windows Journal\Templates\swedish lesbian several models hole (Liz,Christine).rar.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\norwegian handjob big (Janette).zip.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files (x86)\Google\Update\Download\russian cumshot fetish public .mpeg.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\german gay gang bang [free] cock upskirt .avi.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\handjob trambling voyeur boobs sm .zip.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\asian horse trambling girls nipples ash .rar.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\sperm beastiality [milf] feet swallow (Janette,Janette).zip.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files\DVD Maker\Shared\action masturbation .zip.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\swedish beastiality lesbian catfight young .zip.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\indian blowjob catfight titts girly .mpg.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\tyrkish porn sleeping .zip.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\italian gay cum [free] .avi.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\swedish gang bang nude masturbation feet beautyfull .avi.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Windows\mssrv.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\handjob big traffic (Tatjana).mpeg.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\lingerie fucking girls hairy .rar.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\asian trambling [free] boots .avi.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\action hot (!) vagina castration (Britney).rar.exe	f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe

C:\Users\Admin\AppData\Local\Temp\f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
"C:\Users\Admin\AppData\Local\Temp\f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
  "C:\Users\Admin\AppData\Local\Temp\f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe"
  2⤵
  PID:332
- - C:\Users\Admin\AppData\Local\Temp\f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe
    "C:\Users\Admin\AppData\Local\Temp\f468b31ea2bdfa0d8665c8d99c18895c8e28895dae6e8c70ed15425a0e1d8acf.exe"
    3⤵
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\norwegian handjob big (Janette).zip.exe

Filesize
681KB

MD5
0eb5b715e6c2d230226b7ddc87a51593

SHA1
649ebf6443fea781cd030dd44dff78c27b620697

SHA256
82278c08ae612805c085db4555c7357afe0d7e8ee2f89b3b0acf9600f58bd832

SHA512
41f982d879b89ca19c1ee6dec6864a93550d7a9d813d658980b1421635ad7731d830e4d179b7a689dfb58b5e98f7258184b1d142bace8f4d3a39dc33214f9aac

Download Submit
C:\debug.txt

Filesize
183B

MD5
dfb153764d9bcdb0b5c09a08a92aa4d0

SHA1
ee1e1947100d830b9a2c07662b442cc41000b0ee

SHA256
d77faeed23579543659b7b51fccea76c144145025bea5c4d92f4315d354a106f

SHA512
1da7e469514b8ff9afa0cd26852b2be02efc980d19a9ef5d1b3d1300f4de534d551570969c30bbb88591af9a38aaea978c07c3a31ded6327111faaad078df695

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads