Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2023 02:57
Static task
static1
Behavioral task
behavioral1
Sample
FilmoraPromоtiоnVidео.scr
Resource
win7-20230703-en
windows7-x64
8 signatures
1800 seconds
General
-
Target
FilmoraPromоtiоnVidео.scr
-
Size
690.5MB
-
MD5
396e65b6305c12f93342ec94e9dbd7b0
-
SHA1
462ec73a270961e773357222a57540f77c446013
-
SHA256
92d11ab454c85909e43c2d970b2b19101efd5deb16b5d56957a7eacce2c2052d
-
SHA512
b51d93a64d43cd5e9f9965cf6ac152df265150f32a22d02deb4085c905ce7baa8796d98dfd9d20768ab0c5ce63def624cde98a8f74b0c4d9b3efdf5c2ef04510
-
SSDEEP
6144:tK/fF/coWpbk9kwiY7PQHTPy/hHnzhAWNIvZhaj7zMh9gmxY5r:tK/fCfykkEiHzeWNIvZA7IhOmxY5r
Malware Config
Signatures
-
Taurus Stealer payload 1 IoCs
resource yara_rule behavioral2/memory/4232-135-0x0000000000400000-0x000000000047C000-memory.dmp family_taurus_stealer -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\taskschd.msc mmc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4440 timeout.exe -
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2164 mmc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4524 taskmgr.exe Token: SeSystemProfilePrivilege 4524 taskmgr.exe Token: SeCreateGlobalPrivilege 4524 taskmgr.exe Token: SeSecurityPrivilege 4524 taskmgr.exe Token: SeTakeOwnershipPrivilege 4524 taskmgr.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe Token: SeIncBasePriorityPrivilege 2164 mmc.exe Token: 33 2164 mmc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe 4524 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2164 mmc.exe 2164 mmc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4232 wrote to memory of 808 4232 FilmoraPromоtiоnVidео.scr 83 PID 4232 wrote to memory of 808 4232 FilmoraPromоtiоnVidео.scr 83 PID 4232 wrote to memory of 808 4232 FilmoraPromоtiоnVidео.scr 83 PID 808 wrote to memory of 4440 808 cmd.exe 85 PID 808 wrote to memory of 4440 808 cmd.exe 85 PID 808 wrote to memory of 4440 808 cmd.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FilmoraPromоtiоnVidео.scr"C:\Users\Admin\AppData\Local\Temp\FilmoraPromоtiоnVidео.scr" /S1⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\FilmoraProm?ti?nVid??.scr2⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
PID:4440
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4524
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2164