Analysis
-
max time kernel
29s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22-02-2024 12:33
General
-
Target
bac748fad25075d320f06c3cb9cbe4ac2f6c74942add527a469b7731eb46f624.exe
-
Size
2.0MB
-
MD5
d11bb9a351b16eb4613df4b8fa07d2ab
-
SHA1
571a6baacb8a76c605737a1f71088e6ecf4d8f83
-
SHA256
bac748fad25075d320f06c3cb9cbe4ac2f6c74942add527a469b7731eb46f624
-
SHA512
074c6e15377823356fcf60f9476b3a37d683a6879a8565be2de67e42b522d90b9923b792cf40690c4c36209a335965f5fc5a17df4160f6531914267e09799c22
-
SSDEEP
49152:pRq/irm17kZf9bkl36XT5XT1EZzjv1ZL3ft0f149:TqqSdO9bkh6D5D1mzjv19Vk14
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 28 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 38 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bac748fad25075d320f06c3cb9cbe4ac2f6c74942add527a469b7731eb46f624.exe"C:\Users\Admin\AppData\Local\Temp\bac748fad25075d320f06c3cb9cbe4ac2f6c74942add527a469b7731eb46f624.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD500ad76e8d5d904bc5381c3b71719c9aa
SHA1e9827bb8d64a5a964c4cfb188d936479ef53744c
SHA256afa38d96fe1a6f8e29a7aa9629780f343ed551b60abf24747e7d3248cd6ff41d
SHA512e04688332a05b8ecac463b86c343fd17616c13b03b30b26fb898899ecd53b8b4ff1bd01285079ba7c0cf55f4a468b82f241b61c79713edf5e0cedcb9ef2a3564
-
Filesize
1.2MB
MD5d052d8430b3bb42d7d16b7d63693eb9e
SHA10fd2e35202257c89a7b0e4fe12577e6d190e074d
SHA2560578b304d2c35530c3ac5dc42eb868cb5bbb44faeb10daf711aee44edf3c4779
SHA5126c4aae7a4a383402040d7a08b4e95d7fef248c6194025f034627698da484eeaf189afed1bccc4b036cf0e3b76d57d7812cc9680cfbf438ae6dbc17dc9d992865
-
Filesize
1.5MB
MD5db6327d9a6e5a31891853c746214703e
SHA183475a2a2ec97d42538f9dfb7c3bf9db01ae7ffe
SHA2568f90f334f6186d04907672286fd61844725fd2054123c46009b033a9819852bd
SHA512cd277a4ced3eebda2db98d49d0eaa56c41ca8d0ea53a708e5be7b3d21eb826b288d15db84de96cadef209bc4429adfd13ca856c54cb2b87709e93667d20b29f3
-
Filesize
2.1MB
MD5286bf7d52af5924991281c6972d02d11
SHA10accc89560221f27a35cdf25130a28eee28b1583
SHA256748c45b3d02b77ba1d049ea2537ec43c0d2933e375b7e22f749e7dea82464052
SHA51202c61cc72a342e4f92884ac4da89eb0e9f4e6b03fe67c976a85ea05269e2d1a2c33365d9a2d5cdc7b29129a04cdf3da8d55c66204395bdfea705a9b7585de7da
-
Filesize
1.2MB
MD59287e8a1c31434b11e0e9ce0793435d1
SHA1b05efb2fd66efa28bf4b73007d97a4f52b4e9aea
SHA2569049aa08b0ddf02ab2418c7473af33d1ccdbd8c2e53d80de222a31397375e61f
SHA5126fbbd01c7cbf52f99d0d1950169dd74a92e9d97350ac68b7d3fa118d20ed28aedc679e6929e45bc9eb73e48b822404f3d1051ef31036725680faa3cf609f7048
-
Filesize
1.7MB
MD5611d4274122e962b6d791cc8d4b51a3b
SHA1fea62cf016adb9f868a33cdbb7f2cf7c6bc2e8f8
SHA2562af0c6300d99c3e4873cad358bfe372550a950db3265159df3770475f5205441
SHA512beeb3672dc1601430b367940287a0f590da6983265e5c168d46e18402ecfeb9133a6e851243582efedafa04e322f1d7c9a714cda55a0e927b40928dd102c0126
-
Filesize
1.2MB
MD58c02a35cc5a4f876bbba08708f8df321
SHA1511f209b7c02d268081d944b5e1e5753a5449988
SHA256f4299353ef0156faa6728b025242c9a71dd55c27bc6e0404478daac7e40a3be8
SHA512a0ef3585d79ed2daecaaed06c938114a099346cea21c1e7e01e70fe56390eeebc332007d2bb363dfb2f8cb6f6e8d033b71ff6baf2647de3ed4bef2f87911be39
-
Filesize
512KB
MD5377a6095ce8572a63509dd7c0c704780
SHA1a926cd257927716aafdbfd9418a8692a4cf3adb7
SHA256726fb038a9c14769f81e0ab3b178b7871124316da03fff5bc31466d35a224459
SHA512ae6edf1db0b10ca67f8c70c57bf79a9a8b96e990b4a8b2483f159e59a0c597fccef8dd72b0ad8bcd5d15bf9d0dded785d51e6e3463ed458ced58bd3f4a5cc5f0
-
Filesize
1.2MB
MD556de2904d335c39d64e257eb4f66ecfd
SHA1848ccf9aad164c1ef7b5ecc85fe2255ecd267d49
SHA2561c692de9f7ad1a904d0e62e814acd71d79fdbc27eb03082a2516eb03fd40fa99
SHA51225bcec550a2a988738fcad78173c5066d36c21f6e96961c507bed5b486080e5d24e273a4eb19dda48fbb48b99c698a9c0a75d55834a4f223c2b4fd7abdcd3947
-
Filesize
1.6MB
MD58405fdebcd08dfdd14b2b23bee4084fc
SHA115218a8fdc70aba936395eb40f73f4f1278a74bd
SHA2561cba919435600439ee4023503b50a2d2eeb912cba0fd307f30e6298089d282dd
SHA512fb6ec748123be903c486f4e6833bffc55753e1e33342a524def2ae3461a00f5a3151871a2eb09b06a017764ea969ff89a83927a7243d2aed272660178b79b232
-
Filesize
1.2MB
MD5db4b9bb7b72b4086d0ded35e999b5458
SHA126ed889a623695b1662d6b628278bc2971de67ee
SHA2561ffd593bd639fd2e6a56aaf42b855fda50f3b7516405066cdd88974d239d522a
SHA512e5fc2cf57c8c4b98d026ff3a6984e18009e924a0d6163ea361af8f5273f1aaf44e1f80e0d954eeb19509acca6df0cfc350c43896a97ba76861d82f51880d6367
-
Filesize
1.4MB
MD50d747bb0c63bd40acce5140271295b15
SHA1fb1d2e8461f6504dc6588d307164e361d131ba01
SHA256d005a6565e1533d9bf502c8ce0dbea596e30d2ac1c7155e42a2378c9a76e3531
SHA51239fa90373378990c5a7e10dc3428ef9bd78761275994e6f26f1f1bec2a970f063ac963d05fb37be46e600a4a2bf17f5a65f8fcdc31610c851299c32b6086c35f
-
Filesize
1.8MB
MD5abb7b02d7b6f4716dbe1b5c627034cf0
SHA133792f40799a429a4d681f929ce8cdba549274e2
SHA256f705b586ce80f64003d1bf3e79948bd57d71e5a4ac82498cd22cd69445ff80a7
SHA51278dcc07bcb931ff7a4b1df0bcae5a7c3c4bfaef49b14b41c4ed177157aaa755e520ebdbec2ab8d2dd42a90c34a3b4eb3a618084319824a86e52ce296176ba145
-
Filesize
1.3MB
MD53b9f6c52572fbf6b98fc04828c80e2d7
SHA1097f1a7bba68470faad275e1ef8591f44e08045b
SHA2564871ccb560d183018d7d072ef1a0bf1193373bb2af4cbf00b308618fdb693cb7
SHA5120b7952166bfc0fa68dd07de646e66a09e1326a6680b7e9f15ae567140a1c30f5eded6332336faf366a89b391f10d4581f4018c49d961286598288c3718d5d333
-
Filesize
1.5MB
MD5f2783a9136960b3d6e93fdd20faed43f
SHA141947f921fd63fdd23758256078433a2bf108c81
SHA256501407e642acc3cbabeacc9383ccade57bee119184846d899d374fb431381212
SHA5125d65614e5108cee8bad955fbe89a1e167f8b09bd0009df52f2232c73468032e0d1f4a399f9b03a688ee3afbe83b67e98b784c89b33cafa290790d6bb820b264d
-
Filesize
2.0MB
MD5296ccf5e83b88d60ef6196b098465503
SHA1515c50ae9ba5865c455b6d6a9f9f5767a9bb9eb7
SHA2562c8533898d21328b3ea4f95ee5daf3038b2b2c4f3dbf0c0c717c5a7e823f2774
SHA5125d7df3a1d8960dbee9a883c1dd48aa556666bf9581114b184fd6523c77328bf06b4b40f6e811ff5dcb6d61a3ae89be292141d32f195cdb47eaac4284516f58ae
-
Filesize
1.3MB
MD544f2919200d0ed883991e54d1fa407f0
SHA14ac6f30776e841c194f2f79abae37ddb702a0376
SHA256165c316a7e15162b9fe9c657c0afabeb6d3de1ecab66f4ec5028c3161c8c2a1c
SHA5129b84edaf8db1841169672df8be16d600b2bbe613ab4df6256d398d8981a55292b7982ae59f5a964541ac15ac766c2bbbe9066a404837df29e06d72079d4e662e
-
Filesize
1.4MB
MD59485ff44ca92c009de397a17bb0929bf
SHA1da900a07dfbb545c9bf11756d478800d38f4b449
SHA25614d7ece3552ce3949d6a7cb57be09a206c2413d7b9456254744c69093570e8fb
SHA512b6aefce65ab7af52a8c9d20321dc9ba4b31fd57e20e6a5f520d760e40e7809f9cc9dc8338d69bceefd7ca6829bdd77b0443f51ae278b1e35a4a44ccaa3f791c0
-
Filesize
1.2MB
MD570fec1818c950b5f977a7073a41b9d4d
SHA11c9aecf3da45e83fc184f790ee09902134b3721f
SHA2566a5a5ea0e545862267c89edbd0289f755234b0b29b2d61cb6cc803cc1044080e
SHA5122956bd82f23cadb8214abe61fa369c8a4cdd05f0db3a53d3abd78a85cb6fb3bc2e9f89e05c32b732125fcc2e1a2e21f820f16f39f9c97bb0e0cec3f817118e13
-
Filesize
1.3MB
MD5ea2b312bfa458f22181c9d87bc020783
SHA1700f0a3a5b8d0ede6adccdad99933b68699780c2
SHA2564944cd35e70d38838198f6b725544e74247ff6d3e99bdbf333a47e3262258aa2
SHA51208a71021b922612912f65978fb17d73b82e039b62f26ec2d5b491009a2e019c2fcd2c033f0fc979ba7997034fa57be63b01ff834743db79490f12f1dde548e10
-
Filesize
1.4MB
MD5860edd4c3cd759ab08aac3baccde70b8
SHA1d2af7d677f3e639da84444d0560aa5206b1a5725
SHA2562bbbedd0dfda0846c15d820f194741040af0948958d7f77aed467573ba764215
SHA51227cbfceea1cedaccf60191951516e91a38ba634283724d314b9df63759f0f6bb5dc895944b46b08bbaca4b13ce4792f1c994b00ab7b074ac6e8a5d992729e901
-
Filesize
2.1MB
MD5fded7ca6afe955062df3cfc5815c0632
SHA199c0e0c66b4901d75f67ac4b73002edd6b1355eb
SHA25657805d677d50c60b28283652a31efbb8c32ca8427eefa8b63179b1230c4e368e
SHA512c138198a133ed9cfdac620c31634d8cfdb27334ea6743d3dfaf97249ada55b623c402d76d2c5b39a2aa07ecad3e9ddb1edae87b864dde659d8352947ecaf268b
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB