baef8236cdb6321b7c1e697cac99431203a957bb1ee13c60641087bf43806b14

Analysis

max time kernel
89s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2022, 00:30

Target

baef8236cdb6321b7c1e697cac99431203a957bb1ee13c60641087bf43806b14.exe
Size

417KB
MD5

a05ff5c0f978742fae1730bdf51bbae2
SHA1

78c49f0a556b5f5e60e9cc02cb0b445a731add92
SHA256

baef8236cdb6321b7c1e697cac99431203a957bb1ee13c60641087bf43806b14
SHA512

b4982d75bc56e25f13e2bec4dc799030c3598e34335c59e22231ff1bcc530f4e9a048c32ebb1d691c6a151c4a170c8cef24e28f9654a50007ace656a78a8f495
SSDEEP

6144:ymtL0zgTYSE7r11iKHvyHWMS7LQR8laRR0cSpQTtyzsduHNIv:yyQzgTYSKPyT8laRR0TCtyYduHNI

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4512	4916	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4916	baef8236cdb6321b7c1e697cac99431203a957bb1ee13c60641087bf43806b14.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	baef8236cdb6321b7c1e697cac99431203a957bb1ee13c60641087bf43806b14.exe

C:\Users\Admin\AppData\Local\Temp\baef8236cdb6321b7c1e697cac99431203a957bb1ee13c60641087bf43806b14.exe
"C:\Users\Admin\AppData\Local\Temp\baef8236cdb6321b7c1e697cac99431203a957bb1ee13c60641087bf43806b14.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 1556
  2⤵
  - Program crash
  PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4916 -ip 4916
1⤵
PID:972

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/4916-132-0x00000000005DE000-0x000000000060C000-memory.dmp

Filesize
184KB

Download
memory/4916-133-0x00000000021A0000-0x00000000021EB000-memory.dmp

Filesize
300KB

Download
memory/4916-134-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4916-135-0x0000000004F20000-0x00000000054C4000-memory.dmp

Filesize
5.6MB

Download
memory/4916-136-0x00000000054D0000-0x0000000005AE8000-memory.dmp

Filesize
6.1MB

Download
memory/4916-137-0x0000000004D40000-0x0000000004E4A000-memory.dmp

Filesize
1.0MB

Download
memory/4916-138-0x0000000002940000-0x0000000002952000-memory.dmp

Filesize
72KB

Download
memory/4916-139-0x0000000002960000-0x000000000299C000-memory.dmp

Filesize
240KB

Download
memory/4916-140-0x0000000005C90000-0x0000000005D22000-memory.dmp

Filesize
584KB

Download
memory/4916-141-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/4916-142-0x0000000006540000-0x0000000006702000-memory.dmp

Filesize
1.8MB

Download
memory/4916-143-0x0000000006720000-0x0000000006C4C000-memory.dmp

Filesize
5.2MB

Download
memory/4916-144-0x00000000005DE000-0x000000000060C000-memory.dmp

Filesize
184KB

Download
memory/4916-145-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download