Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 18:06
General
-
Target
0103388e96f2479ba1a2fedd1dc2e40de18add6e4b3fee241b02a8cc3cda9d18.exe
-
Size
265KB
-
MD5
e1bd0a0d2009f04ff84bf83feafa2acf
-
SHA1
e666e1638fd70f249a858779ba1770fb0fb6b031
-
SHA256
0103388e96f2479ba1a2fedd1dc2e40de18add6e4b3fee241b02a8cc3cda9d18
-
SHA512
5b8583f44c2ff3554daf8ae7673c465f3e53367407a196afa7f66f357a2001db9a244efe3558deed984e3a2e75f2b1e28a03b19a17e663db5e44ff33470e8f23
-
SSDEEP
6144:4MTvQl40O+zY4joKTO5cLarYGsIuKWf0hbVxfxMVczNZqp25m:jvQuzWox5qssI/WfSVBipMm
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0103388e96f2479ba1a2fedd1dc2e40de18add6e4b3fee241b02a8cc3cda9d18.exe"C:\Users\Admin\AppData\Local\Temp\0103388e96f2479ba1a2fedd1dc2e40de18add6e4b3fee241b02a8cc3cda9d18.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\0103388e96f2479ba1a2fedd1dc2e40de18add6e4b3fee241b02a8cc3cda9d18.exeC:\Users\Admin\AppData\Local\Temp\0103388e96f2479ba1a2fedd1dc2e40de18add6e4b3fee241b02a8cc3cda9d18.exe startC:\Users\Admin\AppData\Roaming\7B299\E4023.exe%C:\Users\Admin\AppData\Roaming\7B2992⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\0103388e96f2479ba1a2fedd1dc2e40de18add6e4b3fee241b02a8cc3cda9d18.exeC:\Users\Admin\AppData\Local\Temp\0103388e96f2479ba1a2fedd1dc2e40de18add6e4b3fee241b02a8cc3cda9d18.exe startC:\Program Files (x86)\994D9\lvvm.exe%C:\Program Files (x86)\994D92⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\LP\2317\56C7.tmp"C:\Program Files (x86)\LP\2317\56C7.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD5132a557d796e8ea31d953c56a01bc693
SHA14864f896c4a98e94a130881a9aa2cd94ac1701b8
SHA25693723e1da6fc91c0ac420ef3b90f74dddfd104cbb52ba6b76b6d87b9a313aa07
SHA512993994b6b3febc3d8b0b09f67121ba8dc0b7fd4771fb0f4da023347bda58d1f187db2bbc9a4cc55701be9a2eed137af4b9d974e89e2db6eea220e66bee3ffefd
-
Filesize
600B
MD5d16d4fbe7a63f62b4d8ac1653c093a8a
SHA16f327d2ad288f26c52d8a244f9d17b8a9e659223
SHA256ee27b38053cabf2d315d5ee580ab4996e877c595617cf98bf3a408d495d27dfc
SHA512c211f294e7e91a2941e518c32e20f1cd83960441e6e3f5f6ea075900ff43b6a86e8a3bb69bd8f98b43f40b8c4e4e33b4000f7febbe3450169d4656eb11d2ae40
-
Filesize
1KB
MD5b731f115a75436aa820c2be1eacba34b
SHA15d8c78b5e8a241480c7761a0f493e0623a2dc006
SHA256b589e8b6357097691a9a196a071cdbe7a9f70b0744fa44411a84ce7d138df8ec
SHA512e93f03915afc1849f89f46fe80e8bd5311a156dae6b891385637a37ebd9bc8c86d2e2fd83c9bfab681c1d795c2125209b0533d47003bf6d66d3740fad60e3088
-
Filesize
96KB
MD5d9ec2cfd319272c1049d6f5c7fbcf347
SHA1b249e163156fa796cfe432aab0bf86ce2d02c5bd
SHA2562826483622a5df655e3984330a011c9ebbada1cadee1b3e374ed1c2207f37196
SHA5124b1d6a68c159f44ec5f1c8669a24f77c53c629f9f85b65ec11842079cef827e6c41943a3a53fbf8ae3b646d1efa8b96498c57e101cf78dea3a9c4c867bb1fcf1
-
Filesize
108KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
416KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
416KB
-
Filesize
424KB