f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe
Size

71KB
MD5

ad1c7213fa3ea00146a920e7db2eb912
SHA1

1f4185b14b7f8f501ea3b1a3e0f67a174822ea3c
SHA256

f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627
SHA512

13235740022d8a9a883f8ce35f8bb96b83a931df792e436caf5ef0001240eec3eff6eb588daa64525a12589464a86c06a826b321cc9725eba56edb2c629aa2ef
SSDEEP

1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTl:ZRpAyazIliazTl

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3956	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3632	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe
Token: SeDebugPrivilege	3956	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3956	3632	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe	85
PID 3632 wrote to memory of 3956	3632	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe	85
PID 3632 wrote to memory of 3956	3632	f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe	85

C:\Users\Admin\AppData\Local\Temp\f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe
"C:\Users\Admin\AppData\Local\Temp\f76d728c7c0c952f02c65f66bea18aab52ac4331f5de7a7aad37297929f29627.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
392KB

MD5
34ee4277a212f13b4c3d913f58f9a697

SHA1
cf15fa6e2bfce0d3d2a9e1425976925d72ec2b1b

SHA256
2d7130b3d2a816b3198f19eaa76554175e04be595daba6e28ca551ac6fc481a3

SHA512
ee38ab4ab03dfb2adc6839a8abc83a0df29fe1a414348dcc7ad2f622b81fa1a79934009615cc551adfdc16c8c268701187bd3c4a57e48204600f6283fb14976a

Download Submit
C:\Users\Admin\AppData\Local\Temp\oGCpYhhn1Tj9n89.exe

Filesize
71KB

MD5
a9e80ba5b7afe701e60915d7a48e91d3

SHA1
b744b10769a39ce537fde1af200194a9db8960f6

SHA256
c7f0be2fefbb661713c543a9d5c899c7e858b1009faf359f61bf2539c5a72d93

SHA512
67671ad94b6fd456d35bc216062e789f0d93c95192b52f1952a687a411955d667803709ce96878f01140d7e77cd2dba5b43bb329bdf8086c9aed38818e362ed4

Download Submit
C:\Windows\CTS.exe

Filesize
71KB

MD5
f9d4ab0a726adc9b5e4b7d7b724912f1

SHA1
3d42ca2098475924f70ee4a831c4f003b4682328

SHA256
b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

SHA512
22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads