559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe
Size

121KB
MD5

9b4a6b7f3e33e71e209f0673af5443d9
SHA1

5988f73963b10fa07137331ca9125327805ca046
SHA256

559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0
SHA512

65f10b1991e61615e4909f22fbf4c9bc874de7711a210fc7013870e7a83b33ed707de6d9d5720588bbc8992e6c9c8c923b6b79b385a1ae6eee72b1203aea35e9
SSDEEP

1536:fmqrP4g3eJG53G73mxdvdhS0TdNmc1CON2uKSqrP4:fxP4g32GhNvXS0Zsc1CON09P4

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://ultimate-search.net/"	559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe

pid	process
992	559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe
992	559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe

description pid process

Token: SeDebugPrivilege 992 559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe

description	pid	process
Token: SeDebugPrivilege	992	559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe

C:\Users\Admin\AppData\Local\Temp\559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe
"C:\Users\Admin\AppData\Local\Temp\559a33347620871dc74578b668dd0a9ffe23a2f67a636b674215f736687c5aa0.exe"
1⤵
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-54-0x000007FEF45A0000-0x000007FEF4FC3000-memory.dmp

Filesize
10.1MB

Download
memory/992-55-0x000007FEF30B0000-0x000007FEF4146000-memory.dmp

Filesize
16.6MB

Download
memory/992-56-0x0000000000B26000-0x0000000000B45000-memory.dmp

Filesize
124KB

Download
memory/992-57-0x0000000000B26000-0x0000000000B45000-memory.dmp

Filesize
124KB

Download