Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    10-10-2024 00:34

General

  • Target

    ad4f601be8e0069f4db65b7d19d066e0a58705f6a70dd4fc2982ab0de1021952.exe

  • Size

    580KB

  • MD5

    618cde762459c080282d9074bdf7f6f8

  • SHA1

    b4a1fa65153e4ecbe505d6e16fee69e51cd0c58c

  • SHA256

    ad4f601be8e0069f4db65b7d19d066e0a58705f6a70dd4fc2982ab0de1021952

  • SHA512

    0edc45b0b6b4ce06bdd603470c2fe70f5b7493957fa74d1c2bf5802d8f4dd377842d1d73ae686c608165f470434bf894538f7ef422faa0c897d948282df07b81

  • SSDEEP

    12288:2aNNTd2p3eZmbtueoiM4TGzqSB3VuVbfrJ/79gUkvjM5a5HGmgZq6:2eTd2pwmbQ9ibWFanavsaxGxk6

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad4f601be8e0069f4db65b7d19d066e0a58705f6a70dd4fc2982ab0de1021952.exe
    "C:\Users\Admin\AppData\Local\Temp\ad4f601be8e0069f4db65b7d19d066e0a58705f6a70dd4fc2982ab0de1021952.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Windows\system32\wscript.exe
      "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\C19A.tmp\C19B.tmp\C19C.vbs //Nologo
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Users\Admin\AppData\Local\Temp\C19A.tmp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\C19A.tmp\file.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\C19A.tmp\file.exe & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\C19A.tmp\file.exe
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2760
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension .exe & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension .exe
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2768
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1932 -s 1416
          4⤵
            PID:2920
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:660

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\C19A.tmp\C19B.tmp\C19C.vbs

        Filesize

        993KB

        MD5

        5a868260808a671876a72a2bcbe51330

        SHA1

        09bdee7ba0a95ccb489c2af57abde901a9a18a69

        SHA256

        423ec3c214f5ce0db6b53c254f480aeee4eb4691404f77405fbb54617d2c047f

        SHA512

        e00f2fee3927a9ef4bd1dec4d480c64bd338ee6bb42ce3c7869962b60ff4052a5dfa9e9fa25c6b6c18ef52cbc7a25c95b7dc868ff80f0873f495cd99b7ea37f6

      • C:\Users\Admin\AppData\Local\Temp\C19A.tmp\file.exe

        Filesize

        136KB

        MD5

        bab3cb62cebe3a18436fa8a60bc32754

        SHA1

        98fca3544509c24d7647f2aca85e021774a93663

        SHA256

        9a2251cd0659f32759f589124a0aec75a046d3137fcb3138dacd87c087d38768

        SHA512

        71805cb421dba13f1869382507f1ac1c1fdf0017ed65512430ca65fc711721bcf1c5eb0743a3d846e35fa8c10fd547a329b08539eff68aabff81fdec773be703

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

        Filesize

        7KB

        MD5

        67c8a61695936a9710657356c39639d3

        SHA1

        4cde3b986f13f32f21589d46564e08d94120503b

        SHA256

        1363430306b1a65f98ea7511de91eebb911290abcce00b207722559a59f21211

        SHA512

        baebb4bbcfab6530505fcb518cfdfa5db53691412d39793639ab01d3f743971caad5be8dbff267ee9bd9eaf73de047a2d4f3ee982b5891cd5ce1fb897e6ab527

      • memory/1932-7-0x000007FEF5EC3000-0x000007FEF5EC4000-memory.dmp

        Filesize

        4KB

      • memory/1932-8-0x00000000001F0000-0x0000000000218000-memory.dmp

        Filesize

        160KB

      • memory/1932-9-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

        Filesize

        9.9MB

      • memory/1932-21-0x000007FEF5EC3000-0x000007FEF5EC4000-memory.dmp

        Filesize

        4KB

      • memory/1932-22-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

        Filesize

        9.9MB

      • memory/2768-19-0x000000001B580000-0x000000001B862000-memory.dmp

        Filesize

        2.9MB

      • memory/2768-20-0x0000000002250000-0x0000000002258000-memory.dmp

        Filesize

        32KB