Analysis
-
max time kernel
155s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
14/03/2024, 23:29
General
-
Target
cbdf882bf39be842a77a1b837c302dbce96687928d0f60c9987f30910719b006.exe
-
Size
615KB
-
MD5
7b3e1263b6cdecc8b1cd1033ffd750e5
-
SHA1
13a43c3d9ed1ae84b680506360daf19c79921ba6
-
SHA256
cbdf882bf39be842a77a1b837c302dbce96687928d0f60c9987f30910719b006
-
SHA512
e62e39345bec93569a5e5eba7ec05e80f3881a0ef781dfee2c930ab4e23a0a8a0af973880835b5fc2a78e2543421c204f09d25b9d11258f26c1d7823facfe61d
-
SSDEEP
12288:aLRRS8Y6Bgvqwkd8dL/2LUGBRWvV/vCmVB9qdBmp7AAHol4chNdT:YS8VBxwkqd2LZjW1xqS73k1hNh
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbdf882bf39be842a77a1b837c302dbce96687928d0f60c9987f30910719b006.exe"C:\Users\Admin\AppData\Local\Temp\cbdf882bf39be842a77a1b837c302dbce96687928d0f60c9987f30910719b006.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 7842⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1852 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD555ecfb44bc8701be1cca4895ac082c60
SHA1bfb0e6baaa9dfce334cf924d8e99161c5b8dca59
SHA2568d9dcf1f0b15f8d5df6a3950ffa4b5c82c30ab247fa0111ce99f0bdf7d3edbdf
SHA5127231317f143950fdb043dfba05b24967e151d036396a45b20579852545777f90cbcf2cf90e05984aa33dadf56f8cda2a03453606142523a80cc49160a3158e62
-
Filesize
781KB
MD5a06c1e2d87424a82fb8998bc6ee8f97c
SHA148af1be9237d8991f522991aeba2867b393a0f1f
SHA256888a0d08848110053b47bb8378242cd141391581b254b0a5749e186d67d0bc0b
SHA512589e4d8b2a8ba66109c85a9f3d7ae0d4a612de1af3c2c2da7485b7ee202bd82df809c1a08be0c72f3f2602af0d3b3f9728b0ed972a47af2756ee144d7a31a531
-
Filesize
805KB
MD5964f5add92bebb2e91676cfac5b728c2
SHA1737d7e184c38c01cf3ace3e1a07edbf3a0016cc3
SHA25683483a6679cf163cc09e34de01efe03308899dc09ad17a63f072ab3c76eb355f
SHA5122c27c88b1625e1b665cb43eca104f19d926cff15a093df5144cc001745cdbb10744a06ce2a98165916d46c600f29356478ed195c2f69becbf4d158e2d1cd2ceb
-
Filesize
2.1MB
MD55e4b4f3a1cf554c3a17d487f8e612e8c
SHA186e68260bc683de46df7fd3bb0797c6dad1d9815
SHA256987bacc9b0a41caaa6bf28fa21ed734dcc5909afb93f08db12996d740984f84f
SHA51257e7f21cff82b6b6d4161e5c0c451e1ce7d0a61123ac87b9517e19be91f82ab03d812d48428fb720d717882857f15ac3e60f0b6608545e7940fc0f4889042de2
-
Filesize
588KB
MD5ff9fd61e948a4a0ee74bfbeaf21a6f0a
SHA1a0a77ab5bca7e0f4c1df533e554eb02cb65ed3e2
SHA25631a8285872e1bc06d798a0f17f8327d494881bb513021f7b1d8e846590b198a8
SHA5124b0c0cf9c384164a8a4905399ebc77232431259d0103ba9586927e09263a54b5f952cdef2107b0e515e82ccc7c31b2d6d709bbe3bdca27d9f691275a43412d88
-
Filesize
1.7MB
MD5cfd89c4dfa264391fe423c8a31be4466
SHA18bbe72576ba648a3456135f739b5beb31a81666b
SHA25616eaf877247c592a104c4a626bbcd7f423a19b76e658688f05029285afa4dfd5
SHA5127f87ea994b52b816353d0345049cf059bef57626cc05a6c2e38207de7348291f9340e3abeca131ed42fc4480f54985162e3f5f6ec5c199277a84ecb746f8f3fb
-
Filesize
659KB
MD594c41f37dfed650d8ce0cb38a66f97e4
SHA1e93054ca4fda9e9d51f0781290ad0cfa6793417f
SHA25608bad2dc423b0d8cfc6c69089537f120eaf3b694bee4e8ac17f79dae6ccc0b8f
SHA512636507bdfce3bd2a72afb501a2f00042e6e07eb5540713b0033584a1f332a56f36f095966ea13f3a4bd1ee681554e933313cbf573cb1144d1ee0da6d9771e415
-
Filesize
1.2MB
MD5abc4067945c3517e4442b53b3c13b66f
SHA159b95a1b6d4b0de4615afde5369a722519fb7cee
SHA2560862648e116ff93efee0d510d15d83b32514fb2fe0503bce751516a9f247b62a
SHA5123ae6b6f8126ba0fcb25852e8879ea1f9efa8ed0e9d06319b80ddadeb972d8626db7d161aa370f7b85a62c53d994b27f20ea71a96160bb0d83b3ba82de6e66314
-
Filesize
578KB
MD55e177ece1ff3ef9870470ebce3777e75
SHA1ab21cf9bf9a2d499692d0cb71b2a035c62571f61
SHA2560f082ec356389f1930d2874a52b1af885a8eca8668dc066700b6c7ce95114702
SHA512cba70eff21f661e60fcc5488efb2e4d6700f15acf21032b68f7623cefd44f1df9c956e67a48071bf352abf245bb8d604656758464076384527722a61e4ab81ab
-
Filesize
940KB
MD5852c7b6b42173a9faad38e88edcff0ca
SHA11f824303609deadb0c3bf6eb467be79d0633a722
SHA256209b9066c6af6d70a42be78496e42a951f42ef2aed4f4cf0e00a9b6350255d1e
SHA512bd786e2c6484b4b4d6b6cf7c43192fc5d9a4920b589d437fb3cadf0d5d91694380cfb81ab2a0f584aec5ef9ca74e07d5f3e68b3d933485a7d0c1b971d0b87dff
-
Filesize
671KB
MD511bfb186eff245eccd1b863dbefc6a3c
SHA188fab734dffb01fba25afc6caeb9b727f1ff2133
SHA2568a7e48fe7adf833217ccc215300bef7014181f170b4499ec7720fa9ae8a163a2
SHA512583c725123e629e84c0258ed7eca1056c67c9cd34f43b3d781cb5bae0d0ea7d24f1a2828e8b0e6b8b6a99f8f015130816f5bb39a0b66c28f203fcc5cbb62175e
-
Filesize
1.4MB
MD522096d235778cb06d9fc11e263e13a02
SHA1b2a58a47bf5da612610b0a7420f48d9ad983df8b
SHA2566ab9c3f7db8e62c08b1e38e642dea4de4b5c4dec229f8967667250065ef002fb
SHA512f64e78273ff2f7c2f05213993f6b60bc4bfa73dc7352f9e2b057bc185817a9da4987634722d2e20c5b80ac73fe42eed5f11fccdf740c1b213f34f1e021efc836
-
Filesize
1.8MB
MD5b45963c27e1201818e176b627ac5c4ff
SHA1c598d37261ea770b5dbebe484af5a57a76792dab
SHA25637e87edd67e250dc7b8caaff994b3fc4ab6fcdfe2aeebce331b51683a5f6d292
SHA512c5163ddf80690734f0af509402ccc9ca88368c86cc69f51e319d64be510e24a29f6a9ba7d6bdb8a7dca77decdf8eddabc37d549c441ed184a3a7ffd1d0fdd185
-
Filesize
429KB
MD5b279a16be454b455c7c73b953ad15f43
SHA1b81be4a1ed55c08b3ad683f1629395eb682e6c48
SHA256f53b012fd9150935351e31ae8f9fc95b6ca3fe672b8b27a8ab8edfbd39ffd068
SHA5126a42174c871954f92b9627f3985a3f3838472e0809ecc107903b16673208b176ed47f2abe551a0ddbdf29e825e8bf060a378a155297dd1cba2e91824c68cf9ab
-
Filesize
885KB
MD518c58a65b11aca0ede36e1010c029c31
SHA1ce7b7ca24cd8b3212d43580e409a787268992bb0
SHA2562be290f0098bf315d09ba78d13112c979add0f3d04c05ab2ff13392aecefd05e
SHA51295d09d43eb50e051e448f363525f51407d06c3b8e3de986c93946f361dc61cf33b628354c98c6d62dcedb796ee94d10838642b48ab41bb8597a3771f7396f30b
-
Filesize
2.0MB
MD5967b45a443eeba700e6e2a70704dd0a4
SHA1365e4ead5bedfd03b6848d3cb9bccc613288b356
SHA256caa9c11380d8b84490071bc1693f13fe4e7babce322e48dc5f3a3ce022f6af57
SHA5123d0ea383ee7e8a19c7cdd2efa55b4438565795e67ae423eb1869e91ec61c4cae48e439d49ef4f6f700b5c430cfa54f1dc47a3d877ea0a6718067874ef3d6207e
-
Filesize
661KB
MD5dff320d0d34c3bebe01797710848f2c5
SHA16185522430a0bfc5f314c154f3e657aca7a7ce1d
SHA2566f44f5e4ebda7b6a6257d30a84432f6549507cab497952d32ca5da95b1e04ac2
SHA512263150a9bfebf596f36ac36d7826382221cf0bdb47f66c87a7724ce88ab977fe6dfc202c884ac4c0abc36cfb322d4feec6e443a3b6c62b97a2eb3651bbb3bb5a
-
Filesize
712KB
MD5170a1efc8c35e5049ef5fe9a5db7c4ef
SHA162853f0abaa20ce05544f3a732046bb3f72923b9
SHA2562e70f7fc6f2f6d9ad4301e77f3297088e522555bf24fa5864d037b6889e87614
SHA5123a377c5a36b0572c3a7fcc599704979fb30386cb774168c8b8bdc6240cab3d7f3bac321536b22c5568f4154c13e00cf16a622faacaf2aebfe93406c8570d331d
-
Filesize
584KB
MD58cd32679f6f5ed38296554d84772ba01
SHA1bef7efcc50fca7d92d9fb8f6de062aba1e5fbd15
SHA25609615a53e61bd02328cfad3895f985da9c4ed265a886de463a73d167ef2a5124
SHA5124ed270dd334e654660e7316f1a36afe7660b5a07f0819b8ae9522c1e399a970aa5453161513127930f7ca145e211b6fff2fc3a376a6265766562b3e7a9410bec
-
Filesize
1.3MB
MD511b08a0c65597358d01c6bc8ade25b94
SHA1dc6d4d4ea5573a37ed388002ba9a1464e4a0a5c1
SHA256b6174ce957d4145c547913da0a754b4b69753c91f747194551802ed82d9adb67
SHA5121fa6bd2969154091aa552b07d69c20938c62505a5da4d065b113c001fa1a6ca9a59e411c8925c47c915ac544bd7b325335d677165e8959f810dc8dcd04084b01
-
Filesize
772KB
MD5e7050b18a6a4dc74baf2984da45936ec
SHA1b7cc0e94e79cfc098e1a60a6da249a85f049d191
SHA25635a82eef2d9a7dccbe4bf49a52e79185e629c329b7b12d671afc853766387d43
SHA512673bd34c4e14f3292391f6e47f0c742daf0ec2a22db2af58ff342d34fcfbc555004ce2749449a347f2432a2059aebaa78b020b57f8847f7ac25721529c9996a5
-
Filesize
2.1MB
MD53c615e685c22d9ae224dc9fee5a316b2
SHA1e07dabbb446a61a48ae67b87f1dc7654bf9e31f5
SHA2565c2e68df50475e3bf97300eb42c3fba675ec1d25e522dd803bc6fffc702f494f
SHA51291961668d6a5c29156d0cd032f4bc63aa20f59e491f91a29f6b6d0028653e48667cec44d8edbbf26273f63dde58ae9e68f94663fd719c9afccb4c4a8643f97d1
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
604KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
604KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
596KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
1.5MB
-
Filesize
1.5MB