c8d717bc9d9c2bd335a79ac5e189d98f36fcd7ab0c62475a7aa7da5fd5ae75d1

Analysis

max time kernel
94s
max time network
99s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ.scr.exe
Size

1.1MB
MD5

f30993e7984ac60c08d69710eaae6ef4
SHA1

5caad7257cb88084ac77915bc6247450fdd7faf1
SHA256

c8d717bc9d9c2bd335a79ac5e189d98f36fcd7ab0c62475a7aa7da5fd5ae75d1
SHA512

c2a9353e6cf3ceb641dc4d4f68917d9d55a23cb8ca1cbc9f6c9ba9492cfb8fc7a8cbcc9a389ad877244afc15fec03204cd747b9a3e073b70a24776143a25bd74
SSDEEP

24576:HEMpzxW67lClGVT2tpH3tJBmqzzz2LA5BEHgeCr0Mn0P6:jWAl/2ndJbzL/EHgtr4C

Score

8^/10

collection discovery execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2792 powershell.exe
9888 powershell.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
2792	powershell.exe
9888	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs

collection

Email Collection

T1114

Processes:

RFQ.scr.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RFQ.scr.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\RFQ.scr = "C:\\Users\\Admin\\AppData\\Roaming\\RFQ.scr.exe"	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ.scr.exe

description pid process target process

PID 2344 set thread context of 2940 2344 RFQ.scr.exe RFQ.scr.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2344 set thread context of 2940	2344	RFQ.scr.exe	RFQ.scr.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

RFQ.scr.exeRFQ.scr.exepowershell.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ.scr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ.scr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

2792 powershell.exe
9888 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RFQ.scr.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2940 RFQ.scr.exe
Token: SeDebugPrivilege 2792 powershell.exe
Token: SeDebugPrivilege 9888 powershell.exe

pid	process
2792	powershell.exe
9888	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2940	RFQ.scr.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	9888	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

RFQ.scr.exeRFQ.scr.exe

description	pid	process	target process
PID 2344 wrote to memory of 2792	2344	RFQ.scr.exe	powershell.exe
PID 2344 wrote to memory of 2792	2344	RFQ.scr.exe	powershell.exe
PID 2344 wrote to memory of 2792	2344	RFQ.scr.exe	powershell.exe
PID 2344 wrote to memory of 2792	2344	RFQ.scr.exe	powershell.exe
PID 2344 wrote to memory of 2940	2344	RFQ.scr.exe	RFQ.scr.exe
PID 2344 wrote to memory of 2940	2344	RFQ.scr.exe	RFQ.scr.exe
PID 2344 wrote to memory of 2940	2344	RFQ.scr.exe	RFQ.scr.exe
PID 2344 wrote to memory of 2940	2344	RFQ.scr.exe	RFQ.scr.exe
PID 2344 wrote to memory of 2940	2344	RFQ.scr.exe	RFQ.scr.exe
PID 2344 wrote to memory of 2940	2344	RFQ.scr.exe	RFQ.scr.exe
PID 2344 wrote to memory of 2940	2344	RFQ.scr.exe	RFQ.scr.exe
PID 2344 wrote to memory of 2940	2344	RFQ.scr.exe	RFQ.scr.exe
PID 2344 wrote to memory of 2940	2344	RFQ.scr.exe	RFQ.scr.exe
PID 2940 wrote to memory of 9888	2940	RFQ.scr.exe	powershell.exe
PID 2940 wrote to memory of 9888	2940	RFQ.scr.exe	powershell.exe
PID 2940 wrote to memory of 9888	2940	RFQ.scr.exe	powershell.exe
PID 2940 wrote to memory of 9888	2940	RFQ.scr.exe	powershell.exe

outlook_office_path 1 IoCs

Processes:

RFQ.scr.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe

outlook_win_path 1 IoCs

Processes:

RFQ.scr.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RFQ.scr.exe

C:\Users\Admin\AppData\Local\Temp\RFQ.scr.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.scr.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQ.scr.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\RFQ.scr.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ.scr.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2940
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'RFQ.scr';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'RFQ.scr' -Value '"C:\Users\Admin\AppData\Roaming\RFQ.scr.exe"' -PropertyType 'String'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:9888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c8d8f64a97c876d03613b0e2c3f65f61

SHA1
5946574a1ef32f9f94f492fd1b27306e9a0b2300

SHA256
feac352bc6724be24625ce893ea4aa297f7285d463f8bac89adccb9d5e0a3535

SHA512
6ded6eaa55cc8fbf77cc074e2e222e6e1cb9bc3cc98c987f55334e569a1af5e1b87d3479d6a74de273ba5af34b789db4388ad4fc589f6bd7916ccc42d835d1b7

Download Submit
memory/2344-0-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/2344-1-0x0000000000B80000-0x0000000000CA0000-memory.dmp

Filesize
1.1MB

Download
memory/2344-2-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2344-3-0x00000000005C0000-0x00000000005D2000-memory.dmp

Filesize
72KB

Download
memory/2344-4-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/2344-5-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2344-6-0x0000000005170000-0x0000000005224000-memory.dmp

Filesize
720KB

Download
memory/2344-25-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2940-7-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2940-22-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2940-23-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2940-24-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2940-19-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2940-17-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2940-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2940-13-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2940-11-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2940-10-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2940-26-0x0000000004370000-0x000000000440C000-memory.dmp

Filesize
624KB

Download
memory/2940-74-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-2899-0x0000000000B50000-0x0000000000B7C000-memory.dmp

Filesize
176KB

Download
memory/2940-2900-0x0000000004C00000-0x0000000004C4C000-memory.dmp

Filesize
304KB

Download
memory/2940-72-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-70-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-68-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-66-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-64-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-62-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-60-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-2901-0x00000000050B0000-0x00000000051A2000-memory.dmp

Filesize
968KB

Download
memory/2940-58-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-56-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-54-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-52-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-50-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-48-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-46-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-44-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-42-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-40-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-38-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-36-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-34-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-32-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-30-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-28-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-27-0x0000000004370000-0x0000000004406000-memory.dmp

Filesize
600KB

Download
memory/2940-7924-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2940-7926-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download