2c4c5516d4e536b8d7fe898eb2655eb3b5f751f0b25e6b4406b6183c6af143a8

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2023, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72eb4032daed12922af27d4cbaefe155_JC.exe
Size

88KB
MD5

72eb4032daed12922af27d4cbaefe155
SHA1

1c1b44fb91e694cdd246fc3cbb9e53c9d2bea076
SHA256

2c4c5516d4e536b8d7fe898eb2655eb3b5f751f0b25e6b4406b6183c6af143a8
SHA512

86d89072181405f6c943ca4e8e22989445eed9068bd957e0edf8cf1b70b77c41958fb4608bc500a7d738d706d7f748c058359ee0c4877fbf0ea10597119fad78
SSDEEP

1536:AKcR4mjD9r823FLWlrUVFHc3vKgAfV8mwrfE2iv:AKcWmjRrz3ZfRc3cfV6r82U

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2468	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	72eb4032daed12922af27d4cbaefe155_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	72eb4032daed12922af27d4cbaefe155_JC.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	72eb4032daed12922af27d4cbaefe155_JC.exe
Token: SeDebugPrivilege	2468	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 2468	4744	72eb4032daed12922af27d4cbaefe155_JC.exe	85
PID 4744 wrote to memory of 2468	4744	72eb4032daed12922af27d4cbaefe155_JC.exe	85
PID 4744 wrote to memory of 2468	4744	72eb4032daed12922af27d4cbaefe155_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\72eb4032daed12922af27d4cbaefe155_JC.exe
"C:\Users\Admin\AppData\Local\Temp\72eb4032daed12922af27d4cbaefe155_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
410KB

MD5
ce50185b528b532142432b6100168208

SHA1
af0eeda6f0440fb66773cb62bf9dd026786baca4

SHA256
cdebef59ff2c109348a5508f9c22a0dc79a9c241f482bbe9a1038844f5ddd4d6

SHA512
cdde076c166e208abb6dc5f4d9f77ccfe8e87f62457c0167486f2908224f16d024b16cd3d09b20b589c26a720d9d3912bdf355c465977fe4c5be6d28b4a025a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\QkQm4mPTQ59lPWU.exe

Filesize
88KB

MD5
fb12f457dec187d508466aef2d3d75df

SHA1
f7cfea5f6099192d8edebe3fa2449aafef1fcd83

SHA256
6808d645b13572a5cb003d6f31cf3f7095f65bddbb60868cb652776ee8f250ff

SHA512
61c9564a75545a3afb6fcb015c62f1192da32d85f23b085d230c51b278b9451f7e609d0f285c63d480a2638130a1835f8b58dea905cfe73dae5893a40e78d25d

Download Submit
C:\Windows\CTS.exe

Filesize
88KB

MD5
3aaf6b72c41bd2d1e5f27673f6723bb2

SHA1
d052796ab99c07f32b7dbaca1d0e92a15bc94e5c

SHA256
f6cbc59159260d679d1d35dcb747a3955e108fc2fb43d5cb6e672b64498895eb

SHA512
bb579c5170e7d1a6d86d7e9d36176694b029368c934acbb2deafb6abacad7aec1180dd6c477d1e20888b2d63a8e9a1d172adf80f66de7f0f6a25a218d3f2247a

Download Submit
C:\Windows\CTS.exe

Filesize
88KB

MD5
3aaf6b72c41bd2d1e5f27673f6723bb2

SHA1
d052796ab99c07f32b7dbaca1d0e92a15bc94e5c

SHA256
f6cbc59159260d679d1d35dcb747a3955e108fc2fb43d5cb6e672b64498895eb

SHA512
bb579c5170e7d1a6d86d7e9d36176694b029368c934acbb2deafb6abacad7aec1180dd6c477d1e20888b2d63a8e9a1d172adf80f66de7f0f6a25a218d3f2247a

Download Submit
memory/2468-8-0x0000000000680000-0x00000000006A4000-memory.dmp

Filesize
144KB

Download
memory/2468-31-0x0000000000680000-0x00000000006A4000-memory.dmp

Filesize
144KB

Download
memory/4744-0-0x0000000000CB0000-0x0000000000CD4000-memory.dmp

Filesize
144KB

Download
memory/4744-7-0x0000000000CB0000-0x0000000000CD4000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads