Resubmissions

30-09-2024 09:01

240930-ky1ggs1dmh 10

30-09-2024 08:44

240930-km6t5azhjh 8

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-09-2024 09:01

General

  • Target

    Ref227982472 3611316041 有害物情報.Xlsx.exe

  • Size

    644KB

  • MD5

    2055e529b8767f5ebaee9afcefd16d91

  • SHA1

    521d53678fbba3951f19dd2cfed6e4b0d5ef8914

  • SHA256

    550aeabbe62d5a14363bac014c16acb456fd2d92ea227d5762a85a51466e3404

  • SHA512

    e98333277ff85e147feb5efea6f0376bfbb2cd9bfa361337fdc40c5c211c626b8e7728326d40158e423b33f31eec0cdde3314dee8c19aa82042c747e6aaf01a3

  • SSDEEP

    12288:gUxKiiSUMD8mBsdNnyVyPziLeSAkJuf3TBtN:gUxchMAfdgVUziqSAmud3

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ref227982472 3611316041 有害物情報.Xlsx.exe
    "C:\Users\Admin\AppData\Local\Temp\Ref227982472 3611316041 有害物情報.Xlsx.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ref227982472 3611316041 有害物情報.Xlsx.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2632
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2768
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCWlgOWYFciIYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6EE.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 1080
      2⤵
      • Program crash
      PID:784
  • C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1132
      2⤵
        PID:2848
    • C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
      1⤵
      • Drops file in System32 directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1792
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {DB39FF5C-3ABF-4429-9F9C-54450932276B} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
        C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2072
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1052
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCWlgOWYFciIYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpACE2.tmp"
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1208
        • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
          "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
          3⤵
          • Executes dropped EXE
          PID:1160
        • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe
          "C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • outlook_office_path
          • outlook_win_path
          PID:1528
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1772

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmpD6EE.tmp

        Filesize

        1KB

        MD5

        9ecc9e925e31fe64fbd3ab1ff693be22

        SHA1

        4f2e5dee8b0063246556355354e150a0a2cbc8a8

        SHA256

        4861cea58872e6506461c2b6f06b7dbcfcc046e1c389e237763c927d5c0d7df7

        SHA512

        f67dcabef2a5927b98a235ead7fd73df271688b6b56ababdfec41203f0546b7d382bd52fe1ac2f54fd89ebaa7a99f82615715be0cec30003cf2dcdb9b0635c96

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DNFB7U3DR989M5AZR7NP.temp

        Filesize

        7KB

        MD5

        dc5575d2fdf535a9d7a303d764b2679e

        SHA1

        1d7f59170289e1da6c3a8f253b826286354c55cc

        SHA256

        0154cdcfc7c93146f647adee9074b9d951a8b749a9ce1a266ac7393dfd0ccfe3

        SHA512

        423a65bdeffb694a8a6ec9f212cea6b4b1780af9828be8876ebd9f90cf4570e67c2caa366c4b770794876acaa715bbe7b46e3cd69d9134b2b4cfca09516ae8c1

      • C:\Users\Admin\AppData\Roaming\sCWlgOWYFciIYD.exe

        Filesize

        644KB

        MD5

        2055e529b8767f5ebaee9afcefd16d91

        SHA1

        521d53678fbba3951f19dd2cfed6e4b0d5ef8914

        SHA256

        550aeabbe62d5a14363bac014c16acb456fd2d92ea227d5762a85a51466e3404

        SHA512

        e98333277ff85e147feb5efea6f0376bfbb2cd9bfa361337fdc40c5c211c626b8e7728326d40158e423b33f31eec0cdde3314dee8c19aa82042c747e6aaf01a3

      • memory/1528-74-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1528-73-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1528-62-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1528-64-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1528-66-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1528-68-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1528-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/1528-71-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1792-43-0x000000001D590000-0x000000001D8D6000-memory.dmp

        Filesize

        3.3MB

      • memory/1792-42-0x0000000002C70000-0x0000000002C8E000-memory.dmp

        Filesize

        120KB

      • memory/1992-39-0x0000000074050000-0x000000007473E000-memory.dmp

        Filesize

        6.9MB

      • memory/1992-1-0x00000000012D0000-0x0000000001376000-memory.dmp

        Filesize

        664KB

      • memory/1992-2-0x0000000074050000-0x000000007473E000-memory.dmp

        Filesize

        6.9MB

      • memory/1992-3-0x0000000000470000-0x000000000048E000-memory.dmp

        Filesize

        120KB

      • memory/1992-4-0x000000007405E000-0x000000007405F000-memory.dmp

        Filesize

        4KB

      • memory/1992-6-0x0000000074050000-0x000000007473E000-memory.dmp

        Filesize

        6.9MB

      • memory/1992-21-0x00000000001B0000-0x0000000000218000-memory.dmp

        Filesize

        416KB

      • memory/1992-0-0x000000007405E000-0x000000007405F000-memory.dmp

        Filesize

        4KB

      • memory/2136-46-0x00000000000D0000-0x0000000000176000-memory.dmp

        Filesize

        664KB

      • memory/2788-12-0x000000001D3B0000-0x000000001D6F6000-memory.dmp

        Filesize

        3.3MB

      • memory/2788-10-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-35-0x000007FEF449E000-0x000007FEF449F000-memory.dmp

        Filesize

        4KB

      • memory/2788-36-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-37-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-16-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-11-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-15-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-41-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-14-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-40-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-34-0x00000000021B0000-0x00000000021B1000-memory.dmp

        Filesize

        4KB

      • memory/2788-20-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-9-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-8-0x0000000002700000-0x000000000271E000-memory.dmp

        Filesize

        120KB

      • memory/2788-18-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-7-0x000007FEF449E000-0x000007FEF449F000-memory.dmp

        Filesize

        4KB

      • memory/2788-19-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-5-0x00000000021B0000-0x00000000021B1000-memory.dmp

        Filesize

        4KB

      • memory/2788-17-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-38-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB

      • memory/2788-13-0x000007FEF41E0000-0x000007FEF4B7D000-memory.dmp

        Filesize

        9.6MB