stormkitty | 150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712

Analysis

max time kernel
33s
max time network
34s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 09:34

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
Size

227KB
MD5

1a83a244d9e90a4865aac14bc0e27052
SHA1

d2b65e7aed7657c9915f90f03d46902087479753
SHA256

150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712
SHA512

f4b9d26d8a0841f9425abf038f85563ddee65e2404bc508fd23c8023bb565fd7f0ceaeaadde49c4951d3bbbb93f6b64b3cf610464855a2bf2d418477dd4fe03f
SSDEEP

6144:YzJS6VlWn4bk0+GIKSppY6sdeZywNeGC4xIAY9F:YzdVlHbk0X5SpppMVwfI

Score

10^/10

stormkitty collection credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Client.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\Client.exe"	Client.exe

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\zzzz.exe	family_stormkitty
behavioral1/memory/2932-36-0x0000000001100000-0x0000000001156000-memory.dmp	family_stormkitty

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1784 powershell.exe
2716 powershell.exe
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
Executes dropped EXE 3 IoCs

Processes:

Client.exeLauncher.exezzzz.exe

pid process

2700 Client.exe
2816 Launcher.exe
2932 zzzz.exe
Loads dropped DLL 3 IoCs

Processes:

150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe

pid process

3060 150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
2764
1200
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2700	Client.exe
2816	Launcher.exe
2932	zzzz.exe

pid	process
3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
2764
1200

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

zzzz.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exeClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe"	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\zzzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzzz.exe"	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\WatchDog.exe"	Client.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 4 IoCs

Processes:

zzzz.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Pictures\desktop.ini	zzzz.exe
File created	C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Desktop\desktop.ini	zzzz.exe
File created	C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Documents\desktop.ini	zzzz.exe
File created	C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Downloads\desktop.ini	zzzz.exe

Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 freegeoip.app
15 api.ipify.org
16 api.ipify.org
17 ip-api.com
22 api.ipify.org
23 api.ipify.org
4 freegeoip.app
Drops file in Windows directory 1 IoCs

Processes:

Client.exe

description ioc process

File created C:\Windows\xdwd.dll Client.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

zzzz.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zzzz.exe

flow	ioc
9	freegeoip.app
15	api.ipify.org
16	api.ipify.org
17	ip-api.com
22	api.ipify.org
23	api.ipify.org
4	freegeoip.app

description	ioc	process
File created	C:\Windows\xdwd.dll	Client.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zzzz.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

zzzz.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	zzzz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	zzzz.exe

Modifies registry class 20 IoCs

Processes:

Launcher.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	Launcher.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2532 schtasks.exe

pid	process
2532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exezzzz.exeClient.exeWmiApSrv.exe

pid	process
1784	powershell.exe
2716	powershell.exe
2932	zzzz.exe
2932	zzzz.exe
2932	zzzz.exe
2932	zzzz.exe
2932	zzzz.exe
2932	zzzz.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
1480	WmiApSrv.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe
2700	Client.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exeClient.exepowershell.exezzzz.exeshutdown.exe

description	pid	process
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	2700	Client.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2932	zzzz.exe
Token: SeShutdownPrivilege	708	shutdown.exe
Token: SeRemoteShutdownPrivilege	708	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Launcher.exe

pid process

2816 Launcher.exe

pid	process
2816	Launcher.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exeClient.exeCMD.execmd.exe

description	pid	process	target process
PID 3060 wrote to memory of 1784	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	powershell.exe
PID 3060 wrote to memory of 1784	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	powershell.exe
PID 3060 wrote to memory of 1784	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	powershell.exe
PID 3060 wrote to memory of 2700	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	Client.exe
PID 3060 wrote to memory of 2700	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	Client.exe
PID 3060 wrote to memory of 2700	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	Client.exe
PID 3060 wrote to memory of 2816	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	Launcher.exe
PID 3060 wrote to memory of 2816	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	Launcher.exe
PID 3060 wrote to memory of 2816	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	Launcher.exe
PID 3060 wrote to memory of 2716	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	powershell.exe
PID 3060 wrote to memory of 2716	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	powershell.exe
PID 3060 wrote to memory of 2716	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	powershell.exe
PID 3060 wrote to memory of 2932	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	zzzz.exe
PID 3060 wrote to memory of 2932	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	zzzz.exe
PID 3060 wrote to memory of 2932	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	zzzz.exe
PID 3060 wrote to memory of 2932	3060	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	zzzz.exe
PID 2700 wrote to memory of 3008	2700	Client.exe	CMD.exe
PID 2700 wrote to memory of 3008	2700	Client.exe	CMD.exe
PID 2700 wrote to memory of 3008	2700	Client.exe	CMD.exe
PID 3008 wrote to memory of 2532	3008	CMD.exe	schtasks.exe
PID 3008 wrote to memory of 2532	3008	CMD.exe	schtasks.exe
PID 3008 wrote to memory of 2532	3008	CMD.exe	schtasks.exe
PID 2700 wrote to memory of 2212	2700	Client.exe	cmd.exe
PID 2700 wrote to memory of 2212	2700	Client.exe	cmd.exe
PID 2700 wrote to memory of 2212	2700	Client.exe	cmd.exe
PID 2212 wrote to memory of 708	2212	cmd.exe	shutdown.exe
PID 2212 wrote to memory of 708	2212	cmd.exe	shutdown.exe
PID 2212 wrote to memory of 708	2212	cmd.exe	shutdown.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

zzzz.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe

outlook_win_path 1 IoCs

Processes:

zzzz.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe

C:\Users\Admin\AppData\Local\Temp\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
"C:\Users\Admin\AppData\Local\Temp\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Client.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Users\Admin\AppData\Local\Temp\Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Client.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2532
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\system32\shutdown.exe
      Shutdown /s /f /t 00
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:708
- C:\Users\Admin\AppData\Local\Temp\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zzzz.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\zzzz.exe
  "C:\Users\Admin\AppData\Local\Temp\zzzz.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2932

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1480

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1740

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Desktop\ClearPush.docx

Filesize
747KB

MD5
5256c16c0ccd44812ce5d7db28bdb649

SHA1
2b913ac6ac92ab1665a2ea303ac671a830f56999

SHA256
35792dc5f231c41a74d24bbc8578059b556ee9297bb1b4763aaaf5cd18685c3a

SHA512
52655ea01accd504520c588995950da1d7b91d47814efc6991bbd42d7a8ccc0c65e10fe54ea935a952310b054c47f01671ab7c18c01bce9098c5365720045bf9

Download Submit
C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Desktop\OutClear.php

Filesize
380KB

MD5
1a817d5bd76b542534a7b94ff80003f0

SHA1
9f010d1a0c92b3d4476b6244f011c3b263c6e18e

SHA256
ea79e605ab1b70d6320d041b24e67d776ea942a034301a1e342844426bf48a26

SHA512
fa017ffd364afe3eeb413b3e1bd5644778e4066cc0d36d1db800f07fc30959a38510fd0a185bbd64098330863fab2352b257631431ad43c2d73b3af1b96f50b6

Download Submit
C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Documents\DismountFormat.xlsx

Filesize
15KB

MD5
2fc290862d7a2d7dd638da5c014e4de7

SHA1
a43ded7f81e0dcd29904863282de5e1151215ac9

SHA256
0bd8c7ded7b03c4e83ca19d89da6d268000bc7493a767c4c87a03e4b0fd529f2

SHA512
b32fb94a1e6fbc0e663441161f5092a35ece8ea96eb8f019540e0014b2d2f7173aeb04f454063bc542bfd785c12b674f4e52251c59d1c946d57adb33a6f1a319

Download Submit
C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Documents\FormatApprove.xls

Filesize
534KB

MD5
2842f65751bd4e14c02b2fa74867af4a

SHA1
9e7134c5d5ecc17b183f9e293c2490f341cf60bd

SHA256
1172a23e1cdad17a8ab150cee2ba5c715c9387f1ffde2a125445af9e4d95297e

SHA512
394e383eb4e5e048b28a5a9c605bec2e3b968f593343a89b6fd16b1d400b4eb2f815642391590a1bbe0c88b07cb823385273f2bb1189c64c13181794e10c2d9b

Download Submit
C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Documents\SaveRepair.pdf

Filesize
497KB

MD5
c4bd1964049463fe85e08a1e9a73d3b3

SHA1
353b57ef2434766c8927860af2a2e9078dc4c99f

SHA256
7380b68413e8aad6b2c390b0d6da4701d7ab939aa707d5e78f6ad59701a98d7a

SHA512
2d74531b4ac4e8e183756d4c260b94b2ef04b7e7cee7119b84a5bbf719652fc256524462aa777d4b2560c06921e93e13bf71cbb7a9c6153094ec100cf17aa06c

Download Submit
C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Documents\SendPush.xlsx

Filesize
719KB

MD5
0608143a5b3c72e6ba56927f74ebd1fc

SHA1
530d4fc96ed7ebf24a8897b7c6108baaa0b9c7da

SHA256
036c12001fbed765af362a0c0c481639605daa9cb5b5b13d9e207b9b5593cf29

SHA512
6810c6fb0c10fe8d54c604c0b3d89850ac7a9527d6a0ee267511aa101576e44e0f7f41520918bf5482e7fd69851080d1534e15dc6f6d048e8328120cd101c2f9

Download Submit
C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Downloads\SuspendRename.html

Filesize
724KB

MD5
dd26c159523541674580ee1c1cedd567

SHA1
7131f2ae762756c303159239a82a758a9f1d9132

SHA256
1e200c774b2154d3f543182e5caa8a4f16cdd18f9a1ee27d4e3f1b8fca66fc99

SHA512
5c7ed14b0eb046bb4c0658f56ee3b0ab61b7138b6b6b2a93d2d76e02cff7f90e955575621e84f419bbf1e62627d7a641543b59997be95b392b47a1a0aa4e62a6

Download Submit
C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Downloads\UnregisterHide.doc

Filesize
385KB

MD5
85542f7ad353a9659285e7363435b783

SHA1
deaf8206f9a1c4b01288c0392602cd01301aa3be

SHA256
77f2ae3029ec4905c950d31bb5973ee6c21855e5521b4a2f12182fa1b3ed209a

SHA512
6a9813f140c26668be95e870f3920fcaca9047d420fb06fed4010b4c20a1d4984617a125715de772293a18eea575b2ae1271b2ad2a566c2070195fb36284fd27

Download Submit
C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Pictures\CompressRedo.png

Filesize
373KB

MD5
dcae2a8dde0aa7bd967df1dc373a8252

SHA1
73f21bb3a32e0bd85be54d0cf6d953330c9ebc6e

SHA256
b5ea43cab58d7df57ed0d9d7dc7e0039f4e151cb277b07b57a09533e3d6cd5a7

SHA512
affc5899c3ee569136eb4dda8ebbe0bbcb635d76fa2fb49353ae636700b36b8f98c1f628750ab706128d0a01991350fa6d7cdc27a7ae5e8b202a216933e8d1ad

Download Submit
C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Pictures\ConfirmRestore.svg

Filesize
627KB

MD5
07f06f583d492b7468cceebf53584648

SHA1
57c73601d116cf0d5f24a07b890b4fbe7bd9f36a

SHA256
901472f43ae09b5eede72b3bcc3c72a5e5f59faa5cf48726a18da853b8c1c5ba

SHA512
2bf3cb75ed49ed4ef3584e34d3ed7b28903f77c51bf617b9ed1d3d79e5b05d18369053db20c86f65da9fb13ba51dbc1d20ba01c3bfd0b7d3170068537eeb5886

Download Submit
C:\Users\Admin\AppData\Local\ELZYPTFV\FileGrabber\Pictures\DisconnectMeasure.jpeg

Filesize
500KB

MD5
303edff994099f44f36a46d12de94b10

SHA1
b216b1581a8cf91110924ffb695fa7a6f6f8946c

SHA256
4b01aac22168f01cfa9cd35debfc8305d37504e84432de8c34c10879c8a29599

SHA512
e743cf8af69771ce8627605909c74d1f0056d14e2483d3b94bb872e56059a9fba3c87f1c45cf2e544c13da7938296172bd285306d3539a1c36d79f5289da4bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
100KB

MD5
21560cb75b809cf46626556cd5fbe3ab

SHA1
f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

SHA256
d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

SHA512
21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

Download Submit
C:\Users\Admin\AppData\Local\Temp\zzzz.exe

Filesize
320KB

MD5
de4824c195cf1b2bb498511ef461e49b

SHA1
f15ca6d0e02c785cce091dbd716cd43e3f5a80bd

SHA256
51813dfedbe02f03d08b4728187eadb4948d8be40c9d8fe6e4e1cb61fa7ae209

SHA512
b211a636f2799d90ce38348dbbc7dbc69ac5374129c7896a137f03a57fe78139a030c1edb90cfc4203799d77a8720df431da75986aa1d8b16274030ad1db770a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
18e38b53f1527568ff25be278160fd24

SHA1
b4deeabd0f47bdc7bb989b4307d9db52896cd918

SHA256
1021447d18013f4e33df901b6ef8e4ec5bfaede45a6429fc962926b42db1a170

SHA512
0a4a7f7061de05da424cc937cbb3554edcf4bec4170ab9bfa86a571a9f1cc3a3e3b99df240425ee152d65e2d7943e72887ca6360e998da3c138f8463bdb06fba

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
\Users\Admin\AppData\Local\Temp\Launcher.exe

Filesize
22KB

MD5
4c8f3a1e15f370ca8afe2992902a6e98

SHA1
dc6324d924ac31bea4ad7e4dd6720ecdad3877dd

SHA256
dcdc72549f7ad41cc860738adbeee5e44f02222415fd84ed5c92538ac9049b92

SHA512
b63c4e48f3024edcf1e1391b5df6ff65fc5111849eb093b429fa0f21c03339dbaeff835f18e250758498f3432874b85348530e47b2ada93f6f68615a5ccf66c0

Download Submit
memory/708-375-0x000007FEF1E50000-0x000007FEF1E72000-memory.dmp

Filesize
136KB

Download
memory/1480-295-0x000007FEF15D0000-0x000007FEF15F2000-memory.dmp

Filesize
136KB

Download
memory/1784-7-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/1784-6-0x00000000022F0000-0x0000000002370000-memory.dmp

Filesize
512KB

Download
memory/1784-8-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/2212-376-0x000007FEF1E50000-0x000007FEF1E72000-memory.dmp

Filesize
136KB

Download
memory/2700-18-0x0000000000D40000-0x0000000000D60000-memory.dmp

Filesize
128KB

Download
memory/2700-374-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/2716-27-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/2716-26-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

Filesize
2.9MB

Download
memory/2816-29-0x0000000003C40000-0x0000000003C50000-memory.dmp

Filesize
64KB

Download
memory/2932-36-0x0000000001100000-0x0000000001156000-memory.dmp

Filesize
344KB

Download
memory/3060-1-0x0000000000860000-0x00000000008A0000-memory.dmp

Filesize
256KB

Download
memory/3060-0-0x000007FEF51F3000-0x000007FEF51F4000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads