f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe
Size

71KB
MD5

ad1c7213fa3ea00146a920e7db2eb912
SHA1

1f4185b14b7f8f501ea3b1a3e0f67a174822ea3c
SHA256

f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627
SHA512

13235740022d8a9a883f8ce35f8bb96b83a931df792e436caf5ef0001240eec3eff6eb588daa64525a12589464a86c06a826b321cc9725eba56edb2c629aa2ef
SSDEEP

1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTl:ZRpAyazIliazTl

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2136	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe
Token: SeDebugPrivilege	2136	CTS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2136	2336	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe	28
PID 2336 wrote to memory of 2136	2336	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe	28
PID 2336 wrote to memory of 2136	2336	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe	28
PID 2336 wrote to memory of 2136	2336	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe	28

C:\Users\Admin\AppData\Local\Temp\f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe
"C:\Users\Admin\AppData\Local\Temp\f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oa6WNC6voVDD9Hj.exe

Filesize
71KB

MD5
d7e1cd5003e6ecafaee3641481790ffd

SHA1
04ad7a0f996455f34163e0aaf6142ad9475d2696

SHA256
c1707f8d65f9f2404a562c8db9e5fdee29913434761ec9477812bd510389c260

SHA512
ad16a210f863ed52c731fcd85905b84e4cf1e0b21f07dd98f834b9a1a223551f328b44efcf8e5d7365f729384042c4d1937504068e0de5c58b6a32f4ba29ad2a

Download Submit
C:\Windows\CTS.exe

Filesize
71KB

MD5
f9d4ab0a726adc9b5e4b7d7b724912f1

SHA1
3d42ca2098475924f70ee4a831c4f003b4682328

SHA256
b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

SHA512
22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads