Analysis
- max time kernel
135s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
31/05/2024, 07:45
General
- Target Model Specification.scr.exe
- Size 1.2MB
- Sample240531-jletkscd64
- SHA256 65031e8d6e51d1cc0bcb588d14069f13bf445eb910ca1b4ff9b3351753983396
Malware Config
Signatures
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Model Specification.scr.exe"C:\Users\Admin\AppData\Local\Temp\Model Specification.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Model Specification.scr.exe"C:\Users\Admin\AppData\Local\Temp\Model Specification.scr.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Model Specification.scr';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Model Specification.scr' -Value '"C:\Users\Admin\AppData\Local\Temp\Model Specification.scr.exe"' -PropertyType 'String'3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Model Specification.scr.exe.log
Molvcvtgsid.tmpdb
Unfpp.tmpdb
__PSScriptPolicyTest_qrkg3qcg.lcl.ps1
memory/940-5-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/940-4-0x0000000004FC0000-0x0000000004FCA000-memory.dmp
memory/940-6-0x0000000005000000-0x0000000005016000-memory.dmp
memory/940-7-0x0000000005250000-0x000000000525C000-memory.dmp
memory/940-8-0x0000000005260000-0x000000000526E000-memory.dmp
memory/940-9-0x00000000061F0000-0x000000000630A000-memory.dmp
memory/940-10-0x0000000006660000-0x00000000066FC000-memory.dmp
memory/940-0-0x000000007522E000-0x000000007522F000-memory.dmp
memory/940-3-0x0000000005020000-0x00000000050B2000-memory.dmp
memory/940-2-0x00000000055D0000-0x0000000005B74000-memory.dmp
memory/940-1-0x00000000004D0000-0x000000000060A000-memory.dmp
memory/940-14-0x000000007522E000-0x000000007522F000-memory.dmp
memory/940-17-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/2708-48-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-34-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-36-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-50-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-52-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-80-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-78-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-76-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-74-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-72-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-70-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-69-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-66-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-64-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-62-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-60-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-58-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-56-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-54-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-18-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/2708-46-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-44-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-42-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-38-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-32-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-30-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-28-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-26-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-20-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-40-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-24-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-22-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-19-0x0000000004F30000-0x0000000005040000-memory.dmp
memory/2708-2307-0x00000000050A0000-0x000000000513E000-memory.dmp
memory/2708-2308-0x0000000005040000-0x000000000508C000-memory.dmp
memory/2708-2309-0x0000000005830000-0x000000000585C000-memory.dmp
memory/2708-2310-0x0000000005910000-0x0000000005976000-memory.dmp
memory/2708-2311-0x0000000006230000-0x00000000062AA000-memory.dmp
memory/2708-15-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/2708-16-0x0000000004F30000-0x0000000005046000-memory.dmp
memory/2708-2370-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/2708-2365-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/2708-11-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/2708-2369-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/3568-2382-0x00000000058B0000-0x0000000005C04000-memory.dmp
memory/3568-2366-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/3568-2371-0x00000000055C0000-0x00000000055E2000-memory.dmp
memory/3568-2367-0x0000000004F10000-0x0000000005538000-memory.dmp
memory/3568-2377-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/3568-2364-0x0000000002440000-0x0000000002476000-memory.dmp
memory/3568-2368-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/3568-2383-0x0000000005D50000-0x0000000005D6E000-memory.dmp
memory/3568-2384-0x0000000005E50000-0x0000000005E9C000-memory.dmp
memory/3568-2385-0x0000000006F40000-0x0000000006FD6000-memory.dmp
memory/3568-2386-0x0000000006260000-0x000000000627A000-memory.dmp
memory/3568-2387-0x00000000062B0000-0x00000000062D2000-memory.dmp
memory/3568-2390-0x0000000075220000-0x00000000759D0000-memory.dmp