Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-10-2024 07:00
Static task
static1
Behavioral task
behavioral1
Sample
98512fdc1d3b34e2196ca5b34e14f29c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
98512fdc1d3b34e2196ca5b34e14f29c.exe
Resource
win10v2004-20240802-en
General
-
Target
98512fdc1d3b34e2196ca5b34e14f29c.exe
-
Size
4.8MB
-
MD5
98512fdc1d3b34e2196ca5b34e14f29c
-
SHA1
460f2bbed2bc7419c1664d7f8a9e284e5b9bea83
-
SHA256
1478772a2208da0b42fd08d2e4f3506259d09c50b5af093471d6c874bf19b399
-
SHA512
ba83759ab4a14007c8344fa665329898d520f640cfab6ec7b177b191f423aa9ec9d07577d64fe11d3cbf56be1744f2e66c1fd0c8a6529fd867377e62445cd6a0
-
SSDEEP
3072:patWqvozZqlXS99bMRfCh+T5bOCYEu05ukO3JJ:pMWqcIXS99bMZ5sCYE7O3P
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2536 cmd.exe -
Executes dropped EXE 3 IoCs
pid Process 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 1220 98512fdc1d3b34e2196ca5b34e14f29c.exe 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com 77 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 428 cmd.exe 1068 netsh.exe 1988 cmd.exe 276 netsh.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1664 timeout.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 98512fdc1d3b34e2196ca5b34e14f29c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 98512fdc1d3b34e2196ca5b34e14f29c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 98512fdc1d3b34e2196ca5b34e14f29c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 98512fdc1d3b34e2196ca5b34e14f29c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 98512fdc1d3b34e2196ca5b34e14f29c.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2884 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1908 98512fdc1d3b34e2196ca5b34e14f29c.exe Token: SeDebugPrivilege 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe Token: SeDebugPrivilege 1220 98512fdc1d3b34e2196ca5b34e14f29c.exe Token: SeDebugPrivilege 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2536 1908 98512fdc1d3b34e2196ca5b34e14f29c.exe 31 PID 1908 wrote to memory of 2536 1908 98512fdc1d3b34e2196ca5b34e14f29c.exe 31 PID 1908 wrote to memory of 2536 1908 98512fdc1d3b34e2196ca5b34e14f29c.exe 31 PID 2536 wrote to memory of 2352 2536 cmd.exe 33 PID 2536 wrote to memory of 2352 2536 cmd.exe 33 PID 2536 wrote to memory of 2352 2536 cmd.exe 33 PID 2536 wrote to memory of 1664 2536 cmd.exe 34 PID 2536 wrote to memory of 1664 2536 cmd.exe 34 PID 2536 wrote to memory of 1664 2536 cmd.exe 34 PID 2536 wrote to memory of 2884 2536 cmd.exe 35 PID 2536 wrote to memory of 2884 2536 cmd.exe 35 PID 2536 wrote to memory of 2884 2536 cmd.exe 35 PID 2536 wrote to memory of 2928 2536 cmd.exe 36 PID 2536 wrote to memory of 2928 2536 cmd.exe 36 PID 2536 wrote to memory of 2928 2536 cmd.exe 36 PID 1160 wrote to memory of 1220 1160 taskeng.exe 38 PID 1160 wrote to memory of 1220 1160 taskeng.exe 38 PID 1160 wrote to memory of 1220 1160 taskeng.exe 38 PID 2928 wrote to memory of 428 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 39 PID 2928 wrote to memory of 428 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 39 PID 2928 wrote to memory of 428 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 39 PID 428 wrote to memory of 2832 428 cmd.exe 41 PID 428 wrote to memory of 2832 428 cmd.exe 41 PID 428 wrote to memory of 2832 428 cmd.exe 41 PID 428 wrote to memory of 1068 428 cmd.exe 42 PID 428 wrote to memory of 1068 428 cmd.exe 42 PID 428 wrote to memory of 1068 428 cmd.exe 42 PID 428 wrote to memory of 2796 428 cmd.exe 43 PID 428 wrote to memory of 2796 428 cmd.exe 43 PID 428 wrote to memory of 2796 428 cmd.exe 43 PID 2928 wrote to memory of 1716 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 44 PID 2928 wrote to memory of 1716 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 44 PID 2928 wrote to memory of 1716 2928 98512fdc1d3b34e2196ca5b34e14f29c.exe 44 PID 1716 wrote to memory of 896 1716 cmd.exe 46 PID 1716 wrote to memory of 896 1716 cmd.exe 46 PID 1716 wrote to memory of 896 1716 cmd.exe 46 PID 1716 wrote to memory of 752 1716 cmd.exe 47 PID 1716 wrote to memory of 752 1716 cmd.exe 47 PID 1716 wrote to memory of 752 1716 cmd.exe 47 PID 1716 wrote to memory of 1548 1716 cmd.exe 48 PID 1716 wrote to memory of 1548 1716 cmd.exe 48 PID 1716 wrote to memory of 1548 1716 cmd.exe 48 PID 1160 wrote to memory of 1800 1160 taskeng.exe 50 PID 1160 wrote to memory of 1800 1160 taskeng.exe 50 PID 1160 wrote to memory of 1800 1160 taskeng.exe 50 PID 1800 wrote to memory of 1988 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe 51 PID 1800 wrote to memory of 1988 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe 51 PID 1800 wrote to memory of 1988 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe 51 PID 1988 wrote to memory of 1880 1988 cmd.exe 53 PID 1988 wrote to memory of 1880 1988 cmd.exe 53 PID 1988 wrote to memory of 1880 1988 cmd.exe 53 PID 1988 wrote to memory of 276 1988 cmd.exe 54 PID 1988 wrote to memory of 276 1988 cmd.exe 54 PID 1988 wrote to memory of 276 1988 cmd.exe 54 PID 1988 wrote to memory of 2796 1988 cmd.exe 55 PID 1988 wrote to memory of 2796 1988 cmd.exe 55 PID 1988 wrote to memory of 2796 1988 cmd.exe 55 PID 1800 wrote to memory of 1380 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe 56 PID 1800 wrote to memory of 1380 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe 56 PID 1800 wrote to memory of 1380 1800 98512fdc1d3b34e2196ca5b34e14f29c.exe 56 PID 1380 wrote to memory of 2300 1380 cmd.exe 58 PID 1380 wrote to memory of 2300 1380 cmd.exe 58 PID 1380 wrote to memory of 2300 1380 cmd.exe 58 PID 1380 wrote to memory of 2332 1380 cmd.exe 59 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 98512fdc1d3b34e2196ca5b34e14f29c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98512fdc1d3b34e2196ca5b34e14f29c.exe"C:\Users\Admin\AppData\Local\Temp\98512fdc1d3b34e2196ca5b34e14f29c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "98512fdc1d3b34e2196ca5b34e14f29c" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\98512fdc1d3b34e2196ca5b34e14f29c.exe" &&START "" "C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:2352
-
-
C:\Windows\system32\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
PID:1664
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "98512fdc1d3b34e2196ca5b34e14f29c" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2884
-
-
C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe"C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:2832
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1068
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"5⤵PID:2796
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"4⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:896
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid5⤵
- Event Triggered Execution: Netsh Helper DLL
PID:752
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"5⤵PID:1548
-
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {985AE092-06B2-4931-B60A-F03D5CA2AFCE} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exeC:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
C:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exeC:\Users\Admin\AppData\Local\Starlabs\98512fdc1d3b34e2196ca5b34e14f29c.exe2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1800 -
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:1880
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:276
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"4⤵PID:2796
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"3⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:2300
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid4⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2332
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"4⤵PID:2292
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519cac2c705a3d3b3838f1bd7d4863ad4
SHA1401abb3cedd54cef2031a849b189ab217363ebce
SHA256a85f10c0d07a98fddd454d2b99e706013071915149b899edcfa724aeccd117c3
SHA512fe68742afab62cc02a095c27c24aff203de7e6bab286db46a36b3d1f92433842d8f14f4db4944c0ffc8cf132b6461fdff6a79a72f62f5751296b71ee21e95063
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537e1de7b9c6a9758582a890c1eeeab0b
SHA1c5a55f81a652adaeae546c830e9eb47f5ddf81b1
SHA25625ac7e37c096ec55da9a2528e9272374e8b13fdcaade176f0eeae5bdd579034e
SHA512898f01fd0bbb2fc595108fa4b9219ed9eb82d21fb4673f5d264e64a0a8f87da657f92f83081b4c32369fa2f6811e140dbdc1c0de9df459c1f0be6c265ac53507
-
Filesize
4.8MB
MD598512fdc1d3b34e2196ca5b34e14f29c
SHA1460f2bbed2bc7419c1664d7f8a9e284e5b9bea83
SHA2561478772a2208da0b42fd08d2e4f3506259d09c50b5af093471d6c874bf19b399
SHA512ba83759ab4a14007c8344fa665329898d520f640cfab6ec7b177b191f423aa9ec9d07577d64fe11d3cbf56be1744f2e66c1fd0c8a6529fd867377e62445cd6a0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
4B
MD5786f2d0acade1787dacb21cac85d099c
SHA163ecc933c573dd61f2cd3b173997656856854f4f
SHA256277879fdcbcdb1a17cb16fe503e9191a3bf32dc6c0071f33d69e6e31b3dc4f53
SHA5127c5237425ee7f0684159913111d1487cfed6de2121b25db5896b02d04c8814d6dfbc42342b6e4c28e7458deef5c3c4ebb7105088dcee624f7a622bad58a2dfdb