Analysis
-
max time kernel
79s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13-01-2024 05:31
General
-
Target
686db8036dcad810bbaaf9729e9372d2751fcc91eb49ad3b61f16297df8d17b7.exe
-
Size
1.6MB
-
MD5
bd36aa480c975f46286dec088cb8351b
-
SHA1
090c1f8d1d17cd7ed983543388a79176713f68b5
-
SHA256
686db8036dcad810bbaaf9729e9372d2751fcc91eb49ad3b61f16297df8d17b7
-
SHA512
c58a6e774c99fa673d25c2175569a3e54d6ef4fc3483f3dee3966a1534d1ef25e6320b842bef52ee22ca62463b7340759ebe4c21ddf23124dd2b711cdc1ab6d3
-
SSDEEP
24576:V49BL8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:VYLgDUYmvFur31yAipQCtXxc0H
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\686db8036dcad810bbaaf9729e9372d2751fcc91eb49ad3b61f16297df8d17b7.exe"C:\Users\Admin\AppData\Local\Temp\686db8036dcad810bbaaf9729e9372d2751fcc91eb49ad3b61f16297df8d17b7.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8961⤵
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5556e02c5f6c6eed8779f152d2b891a6d
SHA1f5d8938d4968d90b34389f195586793131e203a7
SHA256647ec55ee24febd04d5147bac2b24218f0f0efe0b560c1bd66a6901ac9654bf5
SHA51234d03d701c982abddf3460721a789e3586cbaed3ad7eeb711a15b2ac18dd00c15e176a7cc5f819ba4f20141aa2c3f6a79d779ac2e2fdaef6294c31e4b358eaec
-
Filesize
382KB
MD5c4195b50be80b9ef22c86839fbf6b959
SHA134106c66f7990469a087a19f5969976d18da9715
SHA256c1faf9ed8a517dcfe8cad0d179865804d86ffc2ae90043819870dc5955affe2f
SHA51227b2826b0c72da093d322ef68c7e472fbb67969685e03062fccfb523323a1ccb4312559083d0ca537745fde8c53d5496f522af0dacb26effa0c53538de92112f
-
Filesize
381KB
MD5c20b1d7f3c37904832f1cbbfb62ab887
SHA18d6b52225c81c6a7b89379d950994f42b225d9b3
SHA256d3643b6798e59187349a8962a404c7b922da3d1c9a75d5ce8b55b47a986e4394
SHA512b5208c050f2a57c5b51eeadf9b1a648417e56b5518892dafed3e8adb991bd81872749ae0560922604528090ca5067857f668d6847d8b123a1f5f75ab038caadb
-
Filesize
1.1MB
MD5e0ba59ac7e3623ec3d0f0c55ccd963bd
SHA16897c287cdb3a17023ad5bc9a9e3e3e1e47e9835
SHA256d56f27d6173e3633f33acd03337a157db33b12a30501c58a3773a3e533cc6aeb
SHA5121590b41074324e647571ad7132c423d3d8bc5d39ab4956b83a85dba2bf20c64de3ce1564064afb30f86de004c8ff598aefa89b7d37f1f1938ace15243253e9b5
-
Filesize
900KB
MD5510472116aa9e31a2c087069b6046599
SHA1b0070a39967c5764f9bf1e4c58f695e9166c5e37
SHA256ef661cfc3902451e5b8744031ebf984888da75c150fb52bd40efc667afe71df7
SHA5122845b7e0a0f051447a4756cd527074150718aa69565c9661b2cb29b62e16707b6ae361ef57d54510adc47c39cbe79306972de4fa44180cffcc6e6e634b0dd805
-
Filesize
1.1MB
MD543b5edb6e5c3394ee4d1bb3c6339a1a9
SHA19b2272f3b6510804dbeff71b27c3cb6118619db1
SHA256ca62308fc519ffb60aa3ea37f68710ad1ea35c7bb522c9e0bb5ee45c8cd6f8ba
SHA512199ad2944ef459c77f99b116de233ef78c6feb9503b227d23e5f0f244d845b87766c088b1c8b4fd7c7dfbb4a218511975a7d76f03547e3724fd15e00cddbd0b4
-
Filesize
92KB
MD5ac0d34b18655cac1979b5077d7ab15fb
SHA1045911c9dabe4fe9c97b7afcd72d09dfe4851443
SHA25647cbf9faf247a4e57e1930d7cd3310f6f100c89e13f45a9c6bf3d9894b0550f3
SHA51232ecb2884d3ef21318c4733086008df59ed257487913446f4161bdc4cf3350138a71d60ff6538cd1d048b087e289e474df8f1d9139dd97179a9812a2a35f03dd
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.6MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
1.5MB
-
Filesize
412KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.7MB
-
Filesize
384KB
-
Filesize
1.7MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB