91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/03/2025, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
Size

780KB
MD5

0c93904abb61aaf75ef8f7210de308e6
SHA1

3eae214dd0cd6051d9dca98392c07085f171f2a7
SHA256

91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62
SHA512

c9c6de347b26c1b76e50cd3c500d1e7f020810562b6eb257f7160efe8fed4b95d4f664f94f0ec1fe6e12640473098008b6d4d1fbf2a4b5ba05e5f62b20539db7
SSDEEP

12288:J2tgXH3sduObXsHylkxlOG6+iJN+CeS9hs7hh8Txf5NTh3ZUaeso9JTaP5lREAmD:gtTClOG6pf33rehWNt3mJ/S

Score

9^/10

discovery

Malware Config

Signatures

Detected Nirsoft tools 5 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/2224-8-0x0000000000400000-0x0000000000498000-memory.dmp	Nirsoft
behavioral1/memory/2224-18-0x0000000000400000-0x0000000000498000-memory.dmp	Nirsoft
behavioral1/memory/2224-13-0x0000000000400000-0x0000000000498000-memory.dmp	Nirsoft
behavioral1/memory/2224-11-0x0000000000400000-0x0000000000498000-memory.dmp	Nirsoft
behavioral1/memory/2224-6-0x0000000000400000-0x0000000000498000-memory.dmp	Nirsoft

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/2224-8-0x0000000000400000-0x0000000000498000-memory.dmp	MailPassView
behavioral1/memory/2224-18-0x0000000000400000-0x0000000000498000-memory.dmp	MailPassView
behavioral1/memory/2224-13-0x0000000000400000-0x0000000000498000-memory.dmp	MailPassView
behavioral1/memory/2224-11-0x0000000000400000-0x0000000000498000-memory.dmp	MailPassView
behavioral1/memory/2224-6-0x0000000000400000-0x0000000000498000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2224-8-0x0000000000400000-0x0000000000498000-memory.dmp	WebBrowserPassView
behavioral1/memory/2224-18-0x0000000000400000-0x0000000000498000-memory.dmp	WebBrowserPassView
behavioral1/memory/2224-13-0x0000000000400000-0x0000000000498000-memory.dmp	WebBrowserPassView
behavioral1/memory/2224-11-0x0000000000400000-0x0000000000498000-memory.dmp	WebBrowserPassView
behavioral1/memory/2224-6-0x0000000000400000-0x0000000000498000-memory.dmp	WebBrowserPassView

Executes dropped EXE 6 IoCs

pid	Process
2788	Windows Update.exe
2816	Windows Update.exe
2404	Windows Update.exe
2860	Windows Update.exe
2692	Windows Update.exe
2872	Windows Update.exe

Loads dropped DLL 6 IoCs

pid	Process
2224	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 2224	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Update.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe
2788	Windows Update.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
Token: SeDebugPrivilege	2788	Windows Update.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2256	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	31
PID 1548 wrote to memory of 2256	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	31
PID 1548 wrote to memory of 2256	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	31
PID 1548 wrote to memory of 2256	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	31
PID 1548 wrote to memory of 2316	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	32
PID 1548 wrote to memory of 2316	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	32
PID 1548 wrote to memory of 2316	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	32
PID 1548 wrote to memory of 2316	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	32
PID 1548 wrote to memory of 280	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	33
PID 1548 wrote to memory of 280	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	33
PID 1548 wrote to memory of 280	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	33
PID 1548 wrote to memory of 280	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	33
PID 1548 wrote to memory of 2224	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	34
PID 1548 wrote to memory of 2224	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	34
PID 1548 wrote to memory of 2224	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	34
PID 1548 wrote to memory of 2224	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	34
PID 1548 wrote to memory of 2224	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	34
PID 1548 wrote to memory of 2224	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	34
PID 1548 wrote to memory of 2224	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	34
PID 1548 wrote to memory of 2224	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	34
PID 1548 wrote to memory of 2224	1548	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	34
PID 2224 wrote to memory of 2788	2224	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	35
PID 2224 wrote to memory of 2788	2224	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	35
PID 2224 wrote to memory of 2788	2224	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	35
PID 2224 wrote to memory of 2788	2224	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	35
PID 2224 wrote to memory of 2788	2224	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	35
PID 2224 wrote to memory of 2788	2224	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	35
PID 2224 wrote to memory of 2788	2224	91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe	35
PID 2788 wrote to memory of 2404	2788	Windows Update.exe	36
PID 2788 wrote to memory of 2404	2788	Windows Update.exe	36
PID 2788 wrote to memory of 2404	2788	Windows Update.exe	36
PID 2788 wrote to memory of 2404	2788	Windows Update.exe	36
PID 2788 wrote to memory of 2404	2788	Windows Update.exe	36
PID 2788 wrote to memory of 2404	2788	Windows Update.exe	36
PID 2788 wrote to memory of 2404	2788	Windows Update.exe	36
PID 2788 wrote to memory of 2816	2788	Windows Update.exe	37
PID 2788 wrote to memory of 2816	2788	Windows Update.exe	37
PID 2788 wrote to memory of 2816	2788	Windows Update.exe	37
PID 2788 wrote to memory of 2816	2788	Windows Update.exe	37
PID 2788 wrote to memory of 2816	2788	Windows Update.exe	37
PID 2788 wrote to memory of 2816	2788	Windows Update.exe	37
PID 2788 wrote to memory of 2816	2788	Windows Update.exe	37
PID 2788 wrote to memory of 2692	2788	Windows Update.exe	38
PID 2788 wrote to memory of 2692	2788	Windows Update.exe	38
PID 2788 wrote to memory of 2692	2788	Windows Update.exe	38
PID 2788 wrote to memory of 2692	2788	Windows Update.exe	38
PID 2788 wrote to memory of 2692	2788	Windows Update.exe	38
PID 2788 wrote to memory of 2692	2788	Windows Update.exe	38
PID 2788 wrote to memory of 2692	2788	Windows Update.exe	38
PID 2788 wrote to memory of 2860	2788	Windows Update.exe	39
PID 2788 wrote to memory of 2860	2788	Windows Update.exe	39
PID 2788 wrote to memory of 2860	2788	Windows Update.exe	39
PID 2788 wrote to memory of 2860	2788	Windows Update.exe	39
PID 2788 wrote to memory of 2860	2788	Windows Update.exe	39
PID 2788 wrote to memory of 2860	2788	Windows Update.exe	39
PID 2788 wrote to memory of 2860	2788	Windows Update.exe	39
PID 2788 wrote to memory of 2872	2788	Windows Update.exe	40
PID 2788 wrote to memory of 2872	2788	Windows Update.exe	40
PID 2788 wrote to memory of 2872	2788	Windows Update.exe	40
PID 2788 wrote to memory of 2872	2788	Windows Update.exe	40
PID 2788 wrote to memory of 2872	2788	Windows Update.exe	40
PID 2788 wrote to memory of 2872	2788	Windows Update.exe	40
PID 2788 wrote to memory of 2872	2788	Windows Update.exe	40

C:\Users\Admin\AppData\Local\Temp\91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
"C:\Users\Admin\AppData\Local\Temp\91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
  "C:\Users\Admin\AppData\Local\Temp\91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe"
  2⤵
  PID:2256
- C:\Users\Admin\AppData\Local\Temp\91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
  "C:\Users\Admin\AppData\Local\Temp\91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe"
  2⤵
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
  "C:\Users\Admin\AppData\Local\Temp\91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe"
  2⤵
  PID:280
- C:\Users\Admin\AppData\Local\Temp\91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe
  "C:\Users\Admin\AppData\Local\Temp\91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Roaming\Windows Update.exe
    "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Roaming\Windows Update.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
      4⤵
      Executes dropped EXE
      PID:2404
  - - C:\Users\Admin\AppData\Roaming\Windows Update.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
      4⤵
      Executes dropped EXE
      PID:2816
  - - C:\Users\Admin\AppData\Roaming\Windows Update.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
      4⤵
      Executes dropped EXE
      PID:2692
  - - C:\Users\Admin\AppData\Roaming\Windows Update.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
      4⤵
      Executes dropped EXE
      PID:2860
  - - C:\Users\Admin\AppData\Roaming\Windows Update.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
      4⤵
      Executes dropped EXE
      PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
780KB

MD5
0c93904abb61aaf75ef8f7210de308e6

SHA1
3eae214dd0cd6051d9dca98392c07085f171f2a7

SHA256
91107f4a383ddb76d6fd153077d57c528551ace7385fb10db1bb3e46c3603b62

SHA512
c9c6de347b26c1b76e50cd3c500d1e7f020810562b6eb257f7160efe8fed4b95d4f664f94f0ec1fe6e12640473098008b6d4d1fbf2a4b5ba05e5f62b20539db7

Download Submit
memory/1548-16-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-1-0x0000000000110000-0x00000000001DC000-memory.dmp

Filesize
816KB

Download
memory/1548-2-0x0000000000370000-0x0000000000384000-memory.dmp

Filesize
80KB

Download
memory/1548-3-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/1548-40-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/1548-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/1548-41-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2224-8-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2224-13-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2224-11-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2224-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2224-6-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2224-5-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2224-19-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2224-18-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2224-34-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2224-17-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2224-4-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2788-28-0x0000000000380000-0x000000000044C000-memory.dmp

Filesize
816KB

Download