7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0.exe
Size 59KB
Sample240407-2m44zagh59
SHA256 7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0
MD5 b9a8943ab28ebe96e8c8cd1d8b5597f8
SHA1 fe0696cfab530dbec3830311a544d7e7091902f4
SHA512 75d00af660c7cfb0de9f27b230afc04bf5ba22240296ee8be40e7ba5825698d728a79826fa6204d06edf2b52bf8f7ec784e59c09dec3bf7f5c9a32959ed241e3
SSDEEP 768:XoNK2cNW0QbRsWjcd+6yBFLqJ4Z8qx70RM8/O/B2ZZcLRAeos:KcNjQlsWjcd+xzl7SMQ2Aeos
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3096	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3644	7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0.exe
Token: SeDebugPrivilege	3096	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 3096	3644	7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0.exe	87
PID 3644 wrote to memory of 3096	3644	7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0.exe	87
PID 3644 wrote to memory of 3096	3644	7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0.exe	87

C:\Users\Admin\AppData\Local\Temp\7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0.exe
"C:\Users\Admin\AppData\Local\Temp\7e9406e316379da4aaa9a0d98fdda60b63a106b868e5c51a1f3934c8ff8301a0.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 382KB
SHA256 eb5770020436cb65bef5691f72d56c162c65df58af6c04078c734d6b03845618
MD5 9b6c90b73743b0678d0b5974a83578e6
SHA1 7bce080b57ea5400da6e54ab634b8e660b29382e
SHA512 9d3c81d418c0810c903212964f9bf8fdf0e2e0eb0417e7ff742e02557100668ba579815b9c5cd342f062ef74e3c3cb3903bd749f23bff39e3fe6d0db6c77a6ff
SSDEEP 6144:aGKU2UvyIm9x/KGPb8Rry60/9XKm579FNWF8MzeEnkV7VEuRO:anUzaIY5NpVXoVnkV7meO
MD5 SHA1 SHA512 SSDEEP

Submit Download

1Caj8aMU8sOkLw6.exe

Path C:\Users\Admin\AppData\Local\Temp\1Caj8aMU8sOkLw6.exe
Size 59KB
SHA256 00d41cd23c8a1eaa1f58bf8d47af16a92543fce94578a16546a17e53619458f4
MD5 8c63945f3f95528e2704888f862df103
SHA1 24496387d376dc95b5e3fed0f412963fe933a1d5
SHA512 2cd9ca71db333dffe0799a2ab692faa6f708fe6404ca7216644badb53511dd221892f91cd4d396abdbb8684a60803c7b3040b74617b34116695d82718deda5d0
SSDEEP 768:XoNK2cNW0QbRsWjcd+6yBFLqJ4Z8qx70RM8/O/B2ZZcLRAeoV:KcNjQlsWjcd+xzl7SMQ2AeoV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 59KB
SHA256 cae4dd6e200b11cc20962b41914be7a9c5c732e88d54169b42f010b48c5b2431
MD5 a7013fd980137854a484ddae4db165c5
SHA1 726b485772138de438aa549bcd271e74cc155969
SHA512 f1e8fad2ebadd68f86b6010ec65144f40003c646aac36ca2ae0d9060b6fb688be8241a401b507633ff7633ed6713294d15122b5561cd1b0a7c4cdda8458912ee
SSDEEP 768:XoNK2cNW0QbRsWjcd+6yBFLqJ4Z8qx70RM8/O/B2ZZcLRAeo:KcNjQlsWjcd+xzl7SMQ2Aeo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3096-7-0x0000000000890000-0x00000000008A3000-memory.dmp

Download

memory/3644-0-0x0000000000FA0000-0x0000000000FB3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads