Analysis
-
max time kernel
119s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/11/2024, 09:36
Static task
static1
Behavioral task
behavioral1
Sample
f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe
Resource
win10v2004-20241007-en
General
-
Target
f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe
-
Size
153KB
-
MD5
e13fb88ca7d0aef839c0ca07eb36d28b
-
SHA1
c020b62797cd6875ba054c40a9b2e416c56c8139
-
SHA256
f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e
-
SHA512
1ac33d19dab7103f32bbf14c615a3d61288a42fcd410fc9de5208dc8dd64f90fe212195905ceb027bd7642157926e3bc2ecac2b45e7432c580793f6b60450051
-
SSDEEP
3072:/P7oGe+wBMxz2h4J9bZJTxlo4D3QO7YSymHCP9ncW+8M7WATFzrNgKolW/C9JTTu:/ToGeXBkyyJ9bZ547O
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1908 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 1364 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1964 netsh.exe 1904 cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2888 timeout.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 1364 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 1076 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeDebugPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeCreateTokenPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeAssignPrimaryTokenPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeIncreaseQuotaPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeSecurityPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeTakeOwnershipPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeLoadDriverPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeSystemtimePrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeBackupPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeRestorePrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeShutdownPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeSystemEnvironmentPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeUndockPrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeManageVolumePrivilege 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: 31 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: 32 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe Token: SeDebugPrivilege 1364 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 1364 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1908 1076 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 31 PID 1076 wrote to memory of 1908 1076 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 31 PID 1076 wrote to memory of 1908 1076 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 31 PID 1908 wrote to memory of 2872 1908 cmd.exe 33 PID 1908 wrote to memory of 2872 1908 cmd.exe 33 PID 1908 wrote to memory of 2872 1908 cmd.exe 33 PID 1908 wrote to memory of 2888 1908 cmd.exe 34 PID 1908 wrote to memory of 2888 1908 cmd.exe 34 PID 1908 wrote to memory of 2888 1908 cmd.exe 34 PID 1908 wrote to memory of 2720 1908 cmd.exe 35 PID 1908 wrote to memory of 2720 1908 cmd.exe 35 PID 1908 wrote to memory of 2720 1908 cmd.exe 35 PID 1908 wrote to memory of 2896 1908 cmd.exe 36 PID 1908 wrote to memory of 2896 1908 cmd.exe 36 PID 1908 wrote to memory of 2896 1908 cmd.exe 36 PID 2896 wrote to memory of 1904 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 38 PID 2896 wrote to memory of 1904 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 38 PID 2896 wrote to memory of 1904 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 38 PID 1904 wrote to memory of 2140 1904 cmd.exe 40 PID 1904 wrote to memory of 2140 1904 cmd.exe 40 PID 1904 wrote to memory of 2140 1904 cmd.exe 40 PID 1904 wrote to memory of 1964 1904 cmd.exe 41 PID 1904 wrote to memory of 1964 1904 cmd.exe 41 PID 1904 wrote to memory of 1964 1904 cmd.exe 41 PID 1904 wrote to memory of 2568 1904 cmd.exe 42 PID 1904 wrote to memory of 2568 1904 cmd.exe 42 PID 1904 wrote to memory of 2568 1904 cmd.exe 42 PID 2896 wrote to memory of 2060 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 43 PID 2896 wrote to memory of 2060 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 43 PID 2896 wrote to memory of 2060 2896 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe 43 PID 2060 wrote to memory of 1496 2060 cmd.exe 45 PID 2060 wrote to memory of 1496 2060 cmd.exe 45 PID 2060 wrote to memory of 1496 2060 cmd.exe 45 PID 2060 wrote to memory of 2304 2060 cmd.exe 46 PID 2060 wrote to memory of 2304 2060 cmd.exe 46 PID 2060 wrote to memory of 2304 2060 cmd.exe 46 PID 2060 wrote to memory of 3064 2060 cmd.exe 47 PID 2060 wrote to memory of 3064 2060 cmd.exe 47 PID 2060 wrote to memory of 3064 2060 cmd.exe 47 PID 2012 wrote to memory of 1364 2012 taskeng.exe 49 PID 2012 wrote to memory of 1364 2012 taskeng.exe 49 PID 2012 wrote to memory of 1364 2012 taskeng.exe 49 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe"C:\Users\Admin\AppData\Local\Temp\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe" &&START "" "C:\Users\Admin\AppData\Local\Starlabs\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:2872
-
-
C:\Windows\system32\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
PID:2888
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2720
-
-
C:\Users\Admin\AppData\Local\Starlabs\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe"C:\Users\Admin\AppData\Local\Starlabs\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2896 -
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:2140
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1964
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"5⤵PID:2568
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"4⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:1496
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid5⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2304
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"5⤵PID:3064
-
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {7EC235A8-FAF7-4EB9-8549-378389A63091} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Starlabs\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exeC:\Users\Admin\AppData\Local\Starlabs\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1364
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Starlabs\f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e.exe
Filesize153KB
MD5e13fb88ca7d0aef839c0ca07eb36d28b
SHA1c020b62797cd6875ba054c40a9b2e416c56c8139
SHA256f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e
SHA5121ac33d19dab7103f32bbf14c615a3d61288a42fcd410fc9de5208dc8dd64f90fe212195905ceb027bd7642157926e3bc2ecac2b45e7432c580793f6b60450051
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
4B
MD59cd3598a91516950427c605ae29cff68
SHA1339012083576ab4752ec23637f1f049fabf1d3f7
SHA2562cafe232be9a37514d28d81a51f83e1da635e017dc744663bdd28cc7f9803a44
SHA512df07de1a8404459a789a856d7f3f7842c31c091ef23373b73279efb3722f5e19d7495c1c8d03129b10ce33c2a7a8fd34228e0b3d74deff23f2a80e70babb18b7