0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20/09/2023, 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe
Size

25KB
MD5

b4115c42d68232ae004a3e4043f2ffbb
SHA1

fc3258270ea4befab364dfcad69a065aad418ae4
SHA256

0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c
SHA512

6fb14352d32af2ea240392858d3f18428038265885621dfefd421980c4c573702f542d6098680c8ef29ff6bd87080a4aa2f5bd3a634ae8eb2f083893b2411527
SSDEEP

384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvB:8Q3LotOPNSQVwVVxGKEvKHrVB

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3008	spoolsv.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Windows\\spoolsv.exe"	0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Windows\\spoolsv.exe"	spoolsv.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\spoolsv.exe	0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe
File created	C:\Windows\spoolsv.exe	spoolsv.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\https:\onsapay.com\loader	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe
Token: SeDebugPrivilege	3008	spoolsv.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3008	1964	0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe	28
PID 1964 wrote to memory of 3008	1964	0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe	28
PID 1964 wrote to memory of 3008	1964	0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe	28
PID 1964 wrote to memory of 3008	1964	0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe	28

C:\Users\Admin\AppData\Local\Temp\0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe
"C:\Users\Admin\AppData\Local\Temp\0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\spoolsv.exe
  "C:\Windows\spoolsv.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2bI5StROF8DT2ZF.exe

Filesize
25KB

MD5
b91688c4167669259d4f15454041f416

SHA1
0d52f3fdfba3fcfde636d742285a32400566776c

SHA256
f81b32a7e8db8e68f4c50d915823137f5b90c6a651bd1ce7865573188acbaad3

SHA512
f8d84dea5dd5a629245a880b79fc6980cc90132a13bd3107a23531dad4a7ca3ad966fea58ef618a48172ca39bb213fb60acc923dfcca7396791da56f257f3621

Download Submit
C:\Users\Admin\AppData\Local\Temp\4184430216\zmstage.exe

Filesize
5.1MB

MD5
de27d56c8f901fef5e9dfeeecd8824a7

SHA1
edda01b47e1f7c27ca6a1d28cf2ebc02d02bb74c

SHA256
36ce95d2eac9fdfb59c53c22634b134b27ad7f213afb54c3b7b8ea92d7c70a51

SHA512
f997dd779748c9931120ceda8845dc28b1250e875ac073700243d0838279ce19591ec587973abc808344b39b1a93790dfab57cbc4eeb8539394922ed2cef6720

Download Submit
C:\Windows\spoolsv.exe

Filesize
25KB

MD5
82071fd2379c64429acf376487fcddff

SHA1
2da42c7eaa62ecee65757b441c939f12b52228fb

SHA256
272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

SHA512
194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

Download Submit
C:\Windows\spoolsv.exe

Filesize
25KB

MD5
82071fd2379c64429acf376487fcddff

SHA1
2da42c7eaa62ecee65757b441c939f12b52228fb

SHA256
272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

SHA512
194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads