Analysis
- max time kernel
143s - max time network
154s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
03/04/2024, 10:01
General
- Target f3ebceb6da29f20d532e43df4c0b744cae9d7e2e8c7b4630a13d085d75a900fc.exe
- Size 1.8MB
- Sample240403-l2dybscc99
- SHA256 f3ebceb6da29f20d532e43df4c0b744cae9d7e2e8c7b4630a13d085d75a900fc
Malware Config
Signatures
- Executes dropped EXE 33 IoCs
- Loads dropped DLL 15 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 17 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 28 IoCs
- Modifies data under HKEY_USERS 51 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 33 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3ebceb6da29f20d532e43df4c0b744cae9d7e2e8c7b4630a13d085d75a900fc.exe"C:\Users\Admin\AppData\Local\Temp\f3ebceb6da29f20d532e43df4c0b744cae9d7e2e8c7b4630a13d085d75a900fc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 25c -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 254 -NGENProcess 258 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 264 -NGENProcess 268 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 26c -NGENProcess 258 -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 5962⤵
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ose.exe
setup.exe
DW20.EXE
dwtrig20.exe
OSE.EXE
GROOVE.EXE
maintenanceservice.exe
maintenanceservice.exe
7z.exe
OSPPSVC.EXE
elevation_service.exe
MSS.log
ngen_service.log
mscorsvw.exe
mscorsvw.exe
ngen_service.log
mscorsvw.exe
perfhost.exe
SearchIndexer.exe
VSSVC.exe
dllhost.exe
ieetwcollector.exe
msiexec.exe
vds.exe
ehrecvr.exe
fxssvc.exe
wmpnetwk.exe
mscorsvw.exe
aspnet_state.exe
Locator.exe
alg.exe
msdtc.exe
snmptrap.exe
WmiApSrv.exe
wbengine.exe
ehsched.exe
memory/612-0-0x0000000000400000-0x00000000005D4000-memory.dmp
memory/612-1-0x0000000001EC0000-0x0000000001F27000-memory.dmp
memory/612-71-0x0000000000400000-0x00000000005D4000-memory.dmp
memory/612-7-0x0000000001EC0000-0x0000000001F27000-memory.dmp
memory/764-72-0x0000000140000000-0x000000014018E000-memory.dmp
memory/860-186-0x00000000741E0000-0x00000000748CE000-memory.dmp
memory/860-253-0x0000000000400000-0x0000000000588000-memory.dmp
memory/860-129-0x00000000002D0000-0x0000000000337000-memory.dmp
memory/860-274-0x00000000741E0000-0x00000000748CE000-memory.dmp
memory/860-145-0x00000000002D0000-0x0000000000337000-memory.dmp
memory/860-136-0x0000000000400000-0x0000000000588000-memory.dmp
memory/888-83-0x0000000100000000-0x0000000100175000-memory.dmp
memory/888-88-0x00000000001D0000-0x0000000000230000-memory.dmp
memory/888-142-0x0000000100000000-0x0000000100175000-memory.dmp
memory/888-81-0x00000000001D0000-0x0000000000230000-memory.dmp
memory/1072-115-0x0000000000440000-0x00000000004A0000-memory.dmp
memory/1072-226-0x0000000140000000-0x0000000140192000-memory.dmp
memory/1072-108-0x0000000000440000-0x00000000004A0000-memory.dmp
memory/1072-111-0x0000000140000000-0x0000000140192000-memory.dmp
memory/1140-120-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/1140-124-0x0000000001430000-0x0000000001431000-memory.dmp
memory/1140-117-0x0000000001380000-0x0000000001390000-memory.dmp
memory/1140-95-0x0000000140000000-0x000000014013C000-memory.dmp
memory/1140-96-0x00000000002B0000-0x0000000000310000-memory.dmp
memory/1140-158-0x0000000140000000-0x000000014013C000-memory.dmp
memory/1140-102-0x00000000002B0000-0x0000000000310000-memory.dmp
memory/1172-264-0x0000000140000000-0x000000014018E000-memory.dmp
memory/1172-160-0x0000000000250000-0x00000000002B0000-memory.dmp
memory/1172-152-0x0000000140000000-0x000000014018E000-memory.dmp
memory/1532-203-0x000007FEF46D0000-0x000007FEF506D000-memory.dmp
memory/1532-281-0x0000000000BC0000-0x0000000000C40000-memory.dmp
memory/1532-271-0x000007FEF46D0000-0x000007FEF506D000-memory.dmp
memory/1532-206-0x0000000000BC0000-0x0000000000C40000-memory.dmp
memory/1532-283-0x0000000000BC0000-0x0000000000C40000-memory.dmp
memory/1532-211-0x000007FEF46D0000-0x000007FEF506D000-memory.dmp
memory/1588-230-0x00000000001D0000-0x0000000000230000-memory.dmp
memory/1588-221-0x0000000140000000-0x0000000140196000-memory.dmp
memory/1940-197-0x0000000140000000-0x00000001401AA000-memory.dmp
memory/1940-204-0x0000000000FA0000-0x0000000001000000-memory.dmp
memory/2088-236-0x000000002E000000-0x000000002E195000-memory.dmp
memory/2120-260-0x0000000001000000-0x0000000001176000-memory.dmp
memory/2120-266-0x0000000000350000-0x00000000003B7000-memory.dmp
memory/2152-19-0x00000000008F0000-0x0000000000950000-memory.dmp
memory/2152-20-0x00000000008F0000-0x0000000000950000-memory.dmp
memory/2152-89-0x0000000100000000-0x0000000100184000-memory.dmp
memory/2152-13-0x0000000100000000-0x0000000100184000-memory.dmp
memory/2152-12-0x00000000008F0000-0x0000000000950000-memory.dmp
memory/2232-126-0x0000000000890000-0x00000000008F0000-memory.dmp
memory/2232-243-0x0000000140000000-0x0000000140237000-memory.dmp
memory/2232-146-0x0000000000890000-0x00000000008F0000-memory.dmp
memory/2232-127-0x0000000140000000-0x0000000140237000-memory.dmp
memory/2252-298-0x0000000100000000-0x0000000100176000-memory.dmp
memory/2252-299-0x0000000000570000-0x00000000005D0000-memory.dmp
memory/2432-122-0x0000000000400000-0x0000000000588000-memory.dmp
memory/2432-52-0x0000000000400000-0x0000000000588000-memory.dmp
memory/2432-53-0x0000000000230000-0x0000000000297000-memory.dmp
memory/2432-58-0x0000000000230000-0x0000000000297000-memory.dmp
memory/2504-103-0x0000000140000000-0x000000014017D000-memory.dmp
memory/2504-26-0x0000000140000000-0x000000014017D000-memory.dmp
memory/2516-216-0x0000000000400000-0x0000000000588000-memory.dmp
memory/2516-232-0x0000000000230000-0x0000000000297000-memory.dmp
memory/2516-282-0x0000000000400000-0x0000000000588000-memory.dmp
memory/2516-300-0x00000000741E0000-0x00000000748CE000-memory.dmp
memory/2528-35-0x00000000002B0000-0x0000000000317000-memory.dmp
memory/2528-30-0x00000000002B0000-0x0000000000317000-memory.dmp
memory/2528-67-0x0000000010000000-0x000000001017F000-memory.dmp
memory/2528-29-0x0000000010000000-0x000000001017F000-memory.dmp
memory/2556-295-0x0000000100000000-0x0000000100192000-memory.dmp
memory/2556-224-0x0000000000580000-0x0000000000712000-memory.dmp
memory/2556-231-0x0000000100000000-0x0000000100192000-memory.dmp
memory/2556-285-0x0000000000580000-0x0000000000712000-memory.dmp
memory/2556-233-0x00000000003F0000-0x0000000000450000-memory.dmp
memory/2632-45-0x0000000010000000-0x0000000010187000-memory.dmp
memory/2632-254-0x0000000100000000-0x0000000100542000-memory.dmp
memory/2632-74-0x0000000010000000-0x0000000010187000-memory.dmp
memory/2632-247-0x0000000100000000-0x0000000100542000-memory.dmp
memory/2632-252-0x0000000000160000-0x00000000001C0000-memory.dmp
memory/2724-229-0x000000002E000000-0x000000002FE1E000-memory.dmp
memory/2724-188-0x0000000000230000-0x0000000000297000-memory.dmp
memory/2932-286-0x0000000000380000-0x00000000003E0000-memory.dmp
memory/2932-279-0x0000000100000000-0x0000000100175000-memory.dmp