Overview

overview

10

Static

static

1

FilmoraPro...о.scr

windows7-x64

10

FilmoraPro...о.scr

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2023 02:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FilmoraPromоtiоnVidео.scr

  • Size

    690.5MB

  • MD5

    396e65b6305c12f93342ec94e9dbd7b0

  • SHA1

    462ec73a270961e773357222a57540f77c446013

  • SHA256

    92d11ab454c85909e43c2d970b2b19101efd5deb16b5d56957a7eacce2c2052d

  • SHA512

    b51d93a64d43cd5e9f9965cf6ac152df265150f32a22d02deb4085c905ce7baa8796d98dfd9d20768ab0c5ce63def624cde98a8f74b0c4d9b3efdf5c2ef04510

  • SSDEEP

    6144:tK/fF/coWpbk9kwiY7PQHTPy/hHnzhAWNIvZhaj7zMh9gmxY5r:tK/fCfykkEiHzeWNIvZA7IhOmxY5r

Score
10/10
taurusdiscoveryspywarestealertrojan

Malware Config

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

    trojanstealertaurus
  • Taurus Stealer payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\FilmoraPromоtiоnVidео.scr
    "C:\Users\Admin\AppData\Local\Temp\FilmoraPromоtiоnVidео.scr" /S
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4232
    • C:\Windows\SysWOW64\cmd.exe
      /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\FilmoraProm?ti?nVid??.scr
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:808
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 3
        3⤵
        • Delays execution with timeout.exe
        PID:4440
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4524
  • C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2164-149-0x000000001D1C0000-0x000000001D1D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2164-156-0x000000001F290000-0x000000001F390000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/2164-155-0x000000001D1C0000-0x000000001D1D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2164-154-0x00007FF428360000-0x00007FF428370000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2164-153-0x000000001D1C0000-0x000000001D1D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2164-152-0x000000001D1C0000-0x000000001D1D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2164-150-0x000000001D1C0000-0x000000001D1D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2164-151-0x000000001D1C0000-0x000000001D1D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4232-134-0x0000000000720000-0x000000000078A000-memory.dmp
    Filesize

    424KB

    Download
  • memory/4232-135-0x0000000000400000-0x000000000047C000-memory.dmp
    Filesize

    496KB

    Download
  • memory/4232-133-0x0000000000400000-0x000000000047C000-memory.dmp
    Filesize

    496KB

    Download
  • memory/4524-138-0x0000024C6BC60000-0x0000024C6BC61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4524-148-0x0000024C6BC60000-0x0000024C6BC61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4524-147-0x0000024C6BC60000-0x0000024C6BC61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4524-146-0x0000024C6BC60000-0x0000024C6BC61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4524-144-0x0000024C6BC60000-0x0000024C6BC61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4524-145-0x0000024C6BC60000-0x0000024C6BC61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4524-142-0x0000024C6BC60000-0x0000024C6BC61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4524-143-0x0000024C6BC60000-0x0000024C6BC61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4524-137-0x0000024C6BC60000-0x0000024C6BC61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4524-136-0x0000024C6BC60000-0x0000024C6BC61000-memory.dmp
    Filesize

    4KB

    Download