Analysis
-
max time kernel
87s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16-04-2024 00:57
General
-
Target
ad36efc26c01722f5f3b252bec702ca69b6d6524c0e9910f465c6b1fb912ca05.exe
-
Size
622KB
-
MD5
a84d3e42fe54fac3f98c067261573a7c
-
SHA1
8001b05bd0db379de0ca7b0bb27356179296852d
-
SHA256
ad36efc26c01722f5f3b252bec702ca69b6d6524c0e9910f465c6b1fb912ca05
-
SHA512
5892caa035475b4ec5fd50bdd996955e6d6b7f8a0a39abb6b6f6621801b10e7444970c7d667ec48f2d758b0c57198062a49889c2feb28534bef43083ffab591f
-
SSDEEP
12288:EueFqXCRQSjMU3O5s+N6NhOlFVlVsTot16+DrgAPs4F2Y7YJba2EUYhsp+yQRi/o:EunSRQ5UOOU62FBnO+E222YJbNEUQKGg
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad36efc26c01722f5f3b252bec702ca69b6d6524c0e9910f465c6b1fb912ca05.exe"C:\Users\Admin\AppData\Local\Temp\ad36efc26c01722f5f3b252bec702ca69b6d6524c0e9910f465c6b1fb912ca05.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 9002⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4244 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5ed760da3e7dbdb56f667305ce591a185
SHA17cb5621f3955379f1f6afabdeb4d59b161912d4a
SHA256efdc41265a3eb73659e6843cb9ebe7d9f90f4f2d174c2e3eab1c275e9e65109e
SHA5122c964ea68e760c4fb643e99b93fe9ce1773b30e0bcbe2fe2b9e47d1a4704ea01c98008b685de471e108150e4d98ba2d35d520b7637713594c277c46ad640e66d
-
Filesize
781KB
MD5fab476cdf7bc6953f6be2f08841d1d96
SHA119788efd36c9bde291213793dcb4c2493961c246
SHA256efd79926de40f18b8a8fad2ad679fa6bab79315086e19cca323f3bc2f2431a7b
SHA5124bad060aafac1be625e1a423359400b7216ab063e05525190749c3781d180c9682b0ec9e37797ae7cfddb26a3904c9e69eef43a8dd59c64941d2b99a8e181804
-
Filesize
805KB
MD5bee3b5dcd81050aa49fa90e0e40b4ff1
SHA1b0862d2dd8fd6f127403513f39020dc1a678e7d6
SHA256484475a6852ce42b63fc3cee4b84d975a4acad92fe711aa873ff1d36d5cad76b
SHA5122d22260ff28c7c471058d8e5c7b63615755aa15d0d5f9467a03b1ec556d901400c7749a173cf3cc08b183740f9acc170c80e1af8ce69bd9ab990b59dd605a126
-
Filesize
2.1MB
MD550aa29ad2a683aba3200f364a1b37733
SHA12b1c8264d0a1304fffe539cf42c46cef0806371c
SHA2567f11f053f416fb3fe8150028b1ae7bc16d267357528e6289a9a1dcce91a9c841
SHA5124c15eb63a95771d0a310e734185f80843dba7261ab9b0e0dd4b1bb65b4dbd97f69ccc85ae7f80e03ce93abea6e39e91a5fac8ce3fcc27d8974795dae0993eb57
-
Filesize
588KB
MD52d2c0e6e479fece9ee49f9cc215ae551
SHA126e4d4f39364d355f0cb3cb0f2080a7121b61eec
SHA25654cbf4e090e177f1b773107f020bd6e4568cecb0971d4cf86cd9751be12e551b
SHA512c1cde5b7668f3781c7186b4aa5d517afc09ec2544339dc0b21b3e71484df960e81a8ad8fe1b1af5f657de3c6ddf31d0ee6d43422ddc061ab809825f8ac205374
-
Filesize
1.7MB
MD5edbb9c2bdaa7018830c48f016b3d1e97
SHA101be2104134fcd66ce51cd73fafdeaa37f9eba06
SHA256a0958c3dd49ac97e253de7920e776944532e30f353847fa1f384488bb9d9ab34
SHA512ee466aa27a9470afbda8eba6cd11cbf4ae2b3373d9e7c87df689a29452776d93b82316375d125154007f5dca1910a0e07dcd2fd52f9c98184d75edcb7fe61426
-
Filesize
659KB
MD569c222079c73f646714b7df77e55cab7
SHA177ec5d9d00e8edeb1fb925864f55f40fc2e5e814
SHA25631acb4bef7030a582a9566e486fadd9dc4a1703623082f5dd51aa3a0712c7af3
SHA5128579660dabe0d4fb2edcc5fe3f06de77e4e5d898153fb13ebeed2c3d6eba92250fc1b0bea5b570940ef05620ccf8932aa331715fad82ac62429cda5d31a03b1e
-
Filesize
1.2MB
MD5cfb63aec3e0435057564709010756ee7
SHA1ae23abf46aa3799bd1c98674c76172ee875a41c5
SHA256d486145c565bc1a07a9c2cf195500fad1143f83b703b19eeadc2899c62c12f7d
SHA512a7bbdd2b83c3462c2741cf0ce3a05e54a4ea60404639618eb63484fa10c8ea4562e245aaa3d15955048343d4f8a6d02a0585954ec9e89509a4bcff158ec67951
-
Filesize
578KB
MD51e074c8f44fcee5b8446a70391e2c21c
SHA1cc2d692652dd5d3f40802c6fdf2636546076edec
SHA256119d1b5dcb2ac1a0fe3ae3764906d3b86714958300dc0fbe8a7bad95e8082f60
SHA512d6283b38da9acfdea2cf5d457f6b1b5d0a06a201478326e16095ec4f66233c328aef3f42616ac2a4c58dd7d3251bb759a8d32deaffa12012772831cf19a33f16
-
Filesize
940KB
MD5b2c197260c49b4358ca0ed04c0e62f78
SHA18e066216b15688171f2182435a516978d91b33cd
SHA256c785ea7528940dcf945e2879554784c694be6a47fd59b79776fd0eb3a3f9ff91
SHA512e987fb357f71a9f5437c131ebfa7c10ddd09f503deef1323aecf237d4416897e5a15f2292fea5d0d7c417e11d694796eef4dc12b9a04a5835876e34ca8053d0a
-
Filesize
671KB
MD54d9d59c57893cca98f0cab27a6c8f960
SHA191434e8961488f68c482174452d64d0f4c9c2936
SHA256f7c2202d1957b64d70738f7b228b5823787cde069058d9ee84451656df7fa01f
SHA512111370b180c1454ba98799d2035292743bfc4f78659faacf6827cad95c0bdd9be94c5cf8782149d0534ade54d20007ecc1da37cb9866c510fd66000082711b4a
-
Filesize
1.2MB
MD59c56cb18c74eb33e1d2fee0e408b8439
SHA1dc656f1a0abbd4f68b4c870dd19133810ad006a2
SHA2566cf972504dc63fd8a548594126844916103c60127d8ec2f106b2cf3daceb35e6
SHA512b646395e6918eac83d3458ed46f9c38cfab46555df29fe22ada317ad1e51b53a63acb4b655c8f47036f6317da2672a291e0188ebbf6095340d4655061d6b13bb
-
Filesize
1.1MB
MD5ae52f60c1685b986a5d7b6fec462b394
SHA11aae3421c678f32f1b5f478f5c10bab320c54013
SHA256cd4832425f01ba3ff035017a94a07faf375324fbdc4c5901c55c1e1215fbad6e
SHA512a368c43ab50feacfb771e14f631582bf2125d5f8a22c66762d3f7bd4b431fdb72d10feaa3cb97628e21b0f8b0589066aac0acc979a0b75fc5a79f75d97a62fcd
-
Filesize
1.4MB
MD5bd5fe3fa5baa70e0a3ce4e3bf7386a6e
SHA19122d9b2920cfd3d889046d267edb0fd7fa84500
SHA2566317cf40c0f140b08e14186b4933dc543ca2ce8491aae4226e7e042a45793aad
SHA512ee07cd339b74f0285bd1bc28eb16f85619a9f40d9e5683fe1cfb8b7661d36a8a41ad753d434d8c79d41c016ab12c9470aab60128a4e8f57ae4a1772ef63d6646
-
Filesize
885KB
MD54d0c05783d906402336dc683f361e425
SHA1e6ac4f61e9a4bfdad7a850524a8b3b0031921dad
SHA256bcde015cf6ec8210d8545343f4c498e50f1626711b94c45046453b907937e773
SHA512312a2fcc36ad10d27694163b37bbecf01d3c9e1b6d89fa84402cd2a6b5dd30d75383d2f887b09fc1c6d4f0f0ed0ea58ed9f97d02ef6e8d8a8b5c26b9479e6aa0
-
Filesize
2.0MB
MD50940c0797254e721333bf92127bb66d8
SHA1b00f43c42fa55baa87e0ec7c8f8f63a9b097fe4f
SHA2560c51abbf2c09eb2a72793a4ac9b9b9c6c93ff0d8e98e1f4fd29a8f5c99116832
SHA512907c120514e43edb93829f330cb4a21eecac8be885358503f5c8ca202d9eb9a7b75124504f3902c7c1d6f46cfbe79f841ff0e07c4235d748088b2ab7f5aa719f
-
Filesize
661KB
MD500722485a8a82f77bbc665d664c2406a
SHA144fef013663ae0a66853959aa2cd55f326b785f1
SHA256b7eedbd7d4154c8293b9ce0de6318c90d28d494aedf5a32a0f50b181c87a42ba
SHA5127c4c1cc46ce801d147036634a0ba5b6f1a81bb36d89d45fc6ae0fc5e9507d61fb74328d00289ef1c1124eb8f1ff642dbc819ca302e4cb29d5a291fd210d856ef
-
Filesize
712KB
MD50d191f523a3d9bff2e68aebe25888cc0
SHA1ce8db1657080c560117b3830b9d228a3198ebfb1
SHA256682c554407123a386a38354ca1af7573b0db47bb97b612f54303fae1f3801503
SHA512f515370ae86ea35e009e78bb589210a7cbd82870b387acca97cd68a1a33621e98f63a51787492b1b39f2ba21e130b30bc3b145f63f556414260b97991b0144f4
-
Filesize
584KB
MD50e522867dac05fd34e15d1de0c9edf98
SHA1a61535092ca283c8efac8f9c235b5f9fccaaf76f
SHA256004c3e063d3d2a8af9febf076493b625fb8c06cb6b488dca155f70a90a367e75
SHA512967e74de7ed2c9086e68f44b0ae8c57934e210d7eb6542bbbcefd0ac2f1d5d4408cfb39ea4663a69fcf1d873bdebe08f750e2ab28723b2937311f33d87969467
-
Filesize
1.3MB
MD5e11b19dbb2fa48018713fa5d988789e4
SHA16958477575033bc76dbcef4aba7a265b823675c7
SHA25622f4566d3caedc27b7235e790eda6d6216629b8c848e8ef1cddf0ed2d58b20b0
SHA51236969069a3dcdedc1e3d5c00f7ce07c82579906ec7c9501d5637e9646e216151ccc98d55b60718ba1ecd861d5b2a89f7a57f4d04ede3770da858981a28de14ef
-
Filesize
772KB
MD50f66eb729e661e47b5b1637bc8cb4fa0
SHA11b636418ee7e628ecc792989e0b2a62977a3af4d
SHA256d6fbbb73908db009b418ab912a883cbfe8fc0e250f1425f722d157b6fb55a02d
SHA512e79457798b1593f87ec2ab1bfe43dde5718366f4b0fea54666267dfce04913f6975c07cd464af1dc405635b42df7eca30bb79c027a12033436760904353d2a9c
-
Filesize
2.1MB
MD5e5ab20e0632ba8f354f6e221b9eb8335
SHA157dac5a1c101e2dbfaacae8437c3e06ede098e4f
SHA2562062f1a342d454733901cbcdb5c2a26769bd20d902d3761194e147bc34a4dc14
SHA51202122d20296f1296cad9eac50418ca6ce5194bed3f995953e249e0411eb5d81de5cc267170fbfde18a3f928a8e4506e4161016a2744dc99bb608149ae9b9da12
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
904KB
-
Filesize
384KB
-
Filesize
904KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
596KB
-
Filesize
384KB
-
Filesize
596KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
412KB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
792KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB