lokibot | 8679bc0899fa881c2df5ee13a0a97fbdb14712ba9599c9d9bfcf8444f68312c8

General

Target

210da055070c2b04b4555752e8e1651b_JaffaCakes118.msi
Size

704KB
MD5

210da055070c2b04b4555752e8e1651b
SHA1

fae84c44f55fc07f7184927cc603eb4c787b5c61
SHA256

8679bc0899fa881c2df5ee13a0a97fbdb14712ba9599c9d9bfcf8444f68312c8
SHA512

8000f5fb663e1e7cb09e823748aa57b13c529de03efe4d3df9a61cb0b23fe54d164b3ea680ce8f67964bb513c42a333e115e45fe9033c11b1739043db5f08177
SSDEEP

12288:9EcB7rgUSPwodwuLE1mdOd7A2YBianCsGCp9dKgAYkx:9EGrbSYeLqmdOd7A2YBianCsGCpLAYkx

Score

10^/10

lokibot collection discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://dymanite.ca/ome/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSIA259.tmp

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSIA259.tmp
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	MSIA259.tmp
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSIA259.tmp

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

MSIA259.tmpMSIA259.tmp

description	pid	process	target process
PID 3068 set thread context of 1912	3068	MSIA259.tmp	MSIA259.tmp
PID 1912 set thread context of 1788	1912	MSIA259.tmp	MSIA259.tmp

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exeMSIA259.tmpDrvInst.exeMSIA259.tmp

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA259.tmp	msiexec.exe
File opened for modification	C:\Windows\win.ini	MSIA259.tmp
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f76a0a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76a0a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76a0a6.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76a0a6.ipi	msiexec.exe
File opened for modification	C:\Windows\win.ini	MSIA259.tmp

Executes dropped EXE 3 IoCs

Processes:

MSIA259.tmpMSIA259.tmpMSIA259.tmp

pid process

3068 MSIA259.tmp
1912 MSIA259.tmp
1788 MSIA259.tmp
Loads dropped DLL 2 IoCs

Processes:

MSIA259.tmpMSIA259.tmp

pid process

3068 MSIA259.tmp
1912 MSIA259.tmp
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

2096 msiexec.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
3068	MSIA259.tmp
1912	MSIA259.tmp
1788	MSIA259.tmp

pid	process
3068	MSIA259.tmp
1912	MSIA259.tmp

pid	process
2096	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MSIA259.tmpMSIA259.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIA259.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIA259.tmp

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2108 msiexec.exe
2108 msiexec.exe

pid	process
2108	msiexec.exe
2108	msiexec.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exeMSIA259.tmp

description	pid	process
Token: SeShutdownPrivilege	2096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2096	msiexec.exe
Token: SeRestorePrivilege	2108	msiexec.exe
Token: SeTakeOwnershipPrivilege	2108	msiexec.exe
Token: SeSecurityPrivilege	2108	msiexec.exe
Token: SeCreateTokenPrivilege	2096	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2096	msiexec.exe
Token: SeLockMemoryPrivilege	2096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2096	msiexec.exe
Token: SeMachineAccountPrivilege	2096	msiexec.exe
Token: SeTcbPrivilege	2096	msiexec.exe
Token: SeSecurityPrivilege	2096	msiexec.exe
Token: SeTakeOwnershipPrivilege	2096	msiexec.exe
Token: SeLoadDriverPrivilege	2096	msiexec.exe
Token: SeSystemProfilePrivilege	2096	msiexec.exe
Token: SeSystemtimePrivilege	2096	msiexec.exe
Token: SeProfSingleProcessPrivilege	2096	msiexec.exe
Token: SeIncBasePriorityPrivilege	2096	msiexec.exe
Token: SeCreatePagefilePrivilege	2096	msiexec.exe
Token: SeCreatePermanentPrivilege	2096	msiexec.exe
Token: SeBackupPrivilege	2096	msiexec.exe
Token: SeRestorePrivilege	2096	msiexec.exe
Token: SeShutdownPrivilege	2096	msiexec.exe
Token: SeDebugPrivilege	2096	msiexec.exe
Token: SeAuditPrivilege	2096	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2096	msiexec.exe
Token: SeChangeNotifyPrivilege	2096	msiexec.exe
Token: SeRemoteShutdownPrivilege	2096	msiexec.exe
Token: SeUndockPrivilege	2096	msiexec.exe
Token: SeSyncAgentPrivilege	2096	msiexec.exe
Token: SeEnableDelegationPrivilege	2096	msiexec.exe
Token: SeManageVolumePrivilege	2096	msiexec.exe
Token: SeImpersonatePrivilege	2096	msiexec.exe
Token: SeCreateGlobalPrivilege	2096	msiexec.exe
Token: SeBackupPrivilege	2380	vssvc.exe
Token: SeRestorePrivilege	2380	vssvc.exe
Token: SeAuditPrivilege	2380	vssvc.exe
Token: SeBackupPrivilege	2108	msiexec.exe
Token: SeRestorePrivilege	2108	msiexec.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2912	DrvInst.exe
Token: SeLoadDriverPrivilege	2912	DrvInst.exe
Token: SeLoadDriverPrivilege	2912	DrvInst.exe
Token: SeLoadDriverPrivilege	2912	DrvInst.exe
Token: SeRestorePrivilege	2108	msiexec.exe
Token: SeTakeOwnershipPrivilege	2108	msiexec.exe
Token: SeRestorePrivilege	2108	msiexec.exe
Token: SeTakeOwnershipPrivilege	2108	msiexec.exe
Token: SeRestorePrivilege	2108	msiexec.exe
Token: SeTakeOwnershipPrivilege	2108	msiexec.exe
Token: SeRestorePrivilege	2108	msiexec.exe
Token: SeTakeOwnershipPrivilege	2108	msiexec.exe
Token: SeRestorePrivilege	2108	msiexec.exe
Token: SeTakeOwnershipPrivilege	2108	msiexec.exe
Token: SeRestorePrivilege	2108	msiexec.exe
Token: SeTakeOwnershipPrivilege	2108	msiexec.exe
Token: SeDebugPrivilege	1788	MSIA259.tmp

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

msiexec.exeMSIA259.tmpMSIA259.tmp

pid process

2096 msiexec.exe
3068 MSIA259.tmp
3068 MSIA259.tmp
1912 MSIA259.tmp
1912 MSIA259.tmp
2096 msiexec.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

MSIA259.tmpMSIA259.tmp

pid process

3068 MSIA259.tmp
3068 MSIA259.tmp
1912 MSIA259.tmp
1912 MSIA259.tmp
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MSIA259.tmpMSIA259.tmp

pid process

3068 MSIA259.tmp
1912 MSIA259.tmp

pid	process
2096	msiexec.exe
3068	MSIA259.tmp
3068	MSIA259.tmp
1912	MSIA259.tmp
1912	MSIA259.tmp
2096	msiexec.exe

pid	process
3068	MSIA259.tmp
3068	MSIA259.tmp
1912	MSIA259.tmp
1912	MSIA259.tmp

pid	process
3068	MSIA259.tmp
1912	MSIA259.tmp

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

msiexec.exeMSIA259.tmpMSIA259.tmp

description	pid	process	target process
PID 2108 wrote to memory of 3068	2108	msiexec.exe	MSIA259.tmp
PID 2108 wrote to memory of 3068	2108	msiexec.exe	MSIA259.tmp
PID 2108 wrote to memory of 3068	2108	msiexec.exe	MSIA259.tmp
PID 2108 wrote to memory of 3068	2108	msiexec.exe	MSIA259.tmp
PID 3068 wrote to memory of 1912	3068	MSIA259.tmp	MSIA259.tmp
PID 3068 wrote to memory of 1912	3068	MSIA259.tmp	MSIA259.tmp
PID 3068 wrote to memory of 1912	3068	MSIA259.tmp	MSIA259.tmp
PID 3068 wrote to memory of 1912	3068	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp
PID 1912 wrote to memory of 1788	1912	MSIA259.tmp	MSIA259.tmp

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

Processes:

MSIA259.tmp

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSIA259.tmp

outlook_win_path 1 IoCs

Processes:

MSIA259.tmp

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSIA259.tmp

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\210da055070c2b04b4555752e8e1651b_JaffaCakes118.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2096

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\Installer\MSIA259.tmp
  "C:\Windows\Installer\MSIA259.tmp" grgdfbfsg
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\Installer\MSIA259.tmp
    "C:\Windows\Installer\MSIA259.tmp" grgdfbfsg
    3⤵
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\Installer\MSIA259.tmp
      "C:\Windows\Installer\MSIA259.tmp" grgdfbfsg
      4⤵
      Accesses Microsoft Outlook profiles
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:1788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A8" "00000000000005DC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Privilege Escalation

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Defense Evasion

System Binary Proxy Execution

1

T1218

Msiexec

1

T1218.007

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76a0a7.rbs

Filesize
663B

MD5
e1a134a086af58243ccfe3505ec2d52c

SHA1
37e6698c8c5bad62f4e9975b2389f6f0060e3a38

SHA256
52f1b862f97fdf4c749da1d905ac39f5f8a99484072e1bc00cf8741f05a880d8

SHA512
2b7f24238b3e321f2139eb89dc8dfbd09da9d8fb1c02c48337914a235f161d66eedb20c15d88df3539c3daee64c03b4ce74d567a373e6c169b237b45ac322aec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Windows\Installer\MSIA259.tmp

Filesize
680KB

MD5
55723c0964059e5cf386d582a9899860

SHA1
833fd26c5667e2502ffd7d214a3078ec27277b0b

SHA256
ca25d81fc11bca2c2759776038eeb276c0b53e9eec5e7c557b52ef95dc7f3eab

SHA512
780c9e0ca34a73a9787cfcc1ca122017db32afc4fc63021ce0d76fe09219d0a5046b74f1ff2b591d79e6b7a976561606f9a65411412cb665b83f4c9160b483f0

Download Submit
C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
memory/1788-24-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1788-26-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1788-72-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads