ad2418b8ffa4ec0c3a15629b3b125b2eebc6ecca4e4b1efab584dba0a794bab1

Analysis

Target

UbisoftInstaller.exe
Size

529KB
MD5

b83c71865a176fbfd4d29f344c01b54c
SHA1

b33d53a303803f99d7940d6b1f9db0c3795b754b
SHA256

ad2418b8ffa4ec0c3a15629b3b125b2eebc6ecca4e4b1efab584dba0a794bab1
SHA512

47d93e4a9cf4d89230f161ab07d39df4406755f6b14f25978f57a5eabd29a016c05242faedace9589ce33b17bc05c3b71025cfc4400f4da03e8e86561beab401

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1492 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

848 timeout.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

UbisoftInstaller.exe

description pid process

Token: SeRestorePrivilege 1680 UbisoftInstaller.exe
Token: SeBackupPrivilege 1680 UbisoftInstaller.exe

pid	process
1492	cmd.exe

pid	process
848	timeout.exe

description	pid	process
Token: SeRestorePrivilege	1680	UbisoftInstaller.exe
Token: SeBackupPrivilege	1680	UbisoftInstaller.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

UbisoftInstaller.execmd.exe

description	pid	process	target process
PID 1680 wrote to memory of 1492	1680	UbisoftInstaller.exe	cmd.exe
PID 1680 wrote to memory of 1492	1680	UbisoftInstaller.exe	cmd.exe
PID 1680 wrote to memory of 1492	1680	UbisoftInstaller.exe	cmd.exe
PID 1680 wrote to memory of 1492	1680	UbisoftInstaller.exe	cmd.exe
PID 1680 wrote to memory of 1492	1680	UbisoftInstaller.exe	cmd.exe
PID 1680 wrote to memory of 1492	1680	UbisoftInstaller.exe	cmd.exe
PID 1680 wrote to memory of 1492	1680	UbisoftInstaller.exe	cmd.exe
PID 1492 wrote to memory of 848	1492	cmd.exe	timeout.exe
PID 1492 wrote to memory of 848	1492	cmd.exe	timeout.exe
PID 1492 wrote to memory of 848	1492	cmd.exe	timeout.exe
PID 1492 wrote to memory of 848	1492	cmd.exe	timeout.exe
PID 1492 wrote to memory of 848	1492	cmd.exe	timeout.exe
PID 1492 wrote to memory of 848	1492	cmd.exe	timeout.exe
PID 1492 wrote to memory of 848	1492	cmd.exe	timeout.exe

C:\Windows\SysWOW64\timeout.exe
timeout /t 3
3⤵
- Delays execution with timeout.exe
PID:848

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/848-4-0x0000000000000000-mapping.dmp

Download
memory/1412-2-0x000007FEF6460000-0x000007FEF66DA000-memory.dmp

Filesize
2.5MB

Download
memory/1492-3-0x0000000000000000-mapping.dmp

Download