Analysis

  • max time kernel
    140s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-06-2024 01:00

General

  • Target

    02f7524fbcca9e5fb197f47eabc66bbe.exe

  • Size

    10.1MB

  • MD5

    02f7524fbcca9e5fb197f47eabc66bbe

  • SHA1

    b172f6a0890fae6d85fca58b47f961693f55843a

  • SHA256

    349838094cda907d089098bfc3a0839a63959b36f40344e4023cec7218acf92e

  • SHA512

    c5d8ec163852a3c993825c9d898234d41f7dfae132d62bb64c412ceb67e0982adfa5235a676f7f2c981758c2ca33b1ce409c52e11f98634c8467ae822a35f2a0

  • SSDEEP

    196608:Pdad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:FadCoXrlAJ7N3pXW2uGzy

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02f7524fbcca9e5fb197f47eabc66bbe.exe
    "C:\Users\Admin\AppData\Local\Temp\02f7524fbcca9e5fb197f47eabc66bbe.exe"
    1⤵
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1320
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4136
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 13D396AAD6C5018467648A3BFC7E0133
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4504
      • C:\Users\Admin\AppData\Local\Temp\A2B63F4F-F902-4778-AB0D-CD6612F46470\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\A2B63F4F-F902-4778-AB0D-CD6612F46470\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2352
      • C:\Users\Admin\AppData\Local\Temp\E4075F79-2C80-4F47-8982-2E9D27B27AAA\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\E4075F79-2C80-4F47-8982-2E9D27B27AAA\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\3E6EA874-E3ED-46BC-A258-15E86C40A829\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1996
        • C:\Users\Admin\AppData\Local\Temp\3E6EA874-E3ED-46BC-A258-15E86C40A829\sender.exe
          C:\Users\Admin\AppData\Local\Temp\3E6EA874-E3ED-46BC-A258-15E86C40A829\sender.exe --send "/status.xml?clid=2382047&uuid=58e02dc9-3ebe-4afc-95ae-02113ed8679e&vnt=Windows 10x64&file-no=8%0A15%0A25%0A45%0A57%0A59%0A102%0A111%0A125%0A129%0A"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:6248
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
    1⤵
      PID:5372

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e5816b1.rbs

      Filesize

      575B

      MD5

      a35c70c22e6dee45fd6dda010bdffa47

      SHA1

      0584d1072758f4079da8711f14126f2565af1120

      SHA256

      06832d5c941f85c638b497732ccf0b0948ddaf5d72c9ae96ed64c606e8bda224

      SHA512

      2b6c3f33f5a959e4a0e35f6d6365cb8922881ef8f4cc80cf5104aa963ac2a0d6d715981e0092da86d0ac1faeb679e1494a43c045aa20b26a70a75a5ce72ea11f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

      Filesize

      1KB

      MD5

      26c0bbd19631c66b3462943385c2d590

      SHA1

      294b3b59a34d9f12655f4c6582042ddf0a0c4ab5

      SHA256

      b5ad09be1935bcd6ea92903252458d36a437d558bd958298c3bb9f4b45e95d03

      SHA512

      3fdcc2124c26da841925091869110b7a4610f2580bcd77c320bd8e96105d100c87d50b850669b524971b080d4eb3178b5ffa2bf851bc3e185059252c46b69b79

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

      Filesize

      1KB

      MD5

      17c39322c6b0ea6ec6b2a3ccee05b3e0

      SHA1

      f9048f67f15595e6eb9b38ab3aa7ec373d350bc9

      SHA256

      d1b45b42156a70fe4dbfdf64a3aec54f064ef9daec17a92be7ad87ab457ab4f8

      SHA512

      a84253f51e5776daaf479598e99caa9084c887c939515a55581cb479c06abdac958cd8949f3a0ffb454b908d2befbdd0f3c283b27afc03a316551135110185a9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

      Filesize

      536B

      MD5

      923e6cc53e302c56adbcc7e64f538c49

      SHA1

      82a77bc69abe3a198ae951c53987c215e8016091

      SHA256

      5b28449d7d0288da7d026d87482404d0d75f0e84e01a51c8d3ba1143b45d680b

      SHA512

      d8672572b332a4de2139c028d349529a6e5e8801d9d9316a089c0091dea6de55feef423d9f3770fb6c38938439f4dee2114500491ddba125ae5f00afb03031a7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

      Filesize

      536B

      MD5

      5f8854a0897fb754b531571e19cc07fd

      SHA1

      c6459441361335dbabd58ce8b774f2c621514ad8

      SHA256

      ac3d7128235e7aad8c9bb130ad69b546da3973721e8120fc2c7ff3011c364c58

      SHA512

      5a09cba998b8784de3ad9b8118db84968d1428ee5a9157d19d48e2b6bf219dfe5b3fc95bc67d3f32be953ec0d7702c304a8908e04b2c28af4471edf1546464d7

    • C:\Users\Admin\AppData\Local\Temp\3E6EA874-E3ED-46BC-A258-15E86C40A829\sender.exe

      Filesize

      260KB

      MD5

      f1a8f60c018647902e70cf3869e1563f

      SHA1

      3caf9c51dfd75206d944d4c536f5f5ff8e225ae9

      SHA256

      36022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577

      SHA512

      c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e

    • C:\Users\Admin\AppData\Local\Temp\A2B63F4F-F902-4778-AB0D-CD6612F46470\lite_installer.exe

      Filesize

      419KB

      MD5

      aafdfaa7a989ddb216510fc9ae5b877f

      SHA1

      41cf94692968a7d511b6051b7fe2b15c784770cb

      SHA256

      688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc

      SHA512

      6e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44

    • C:\Users\Admin\AppData\Local\Temp\E4075F79-2C80-4F47-8982-2E9D27B27AAA\seederexe.exe

      Filesize

      8.6MB

      MD5

      225ba20fa3edd13c9c72f600ff90e6cb

      SHA1

      5f1a9baa85c2afe29619e7cc848036d9174701e4

      SHA256

      35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797

      SHA512

      97e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3

    • C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log

      Filesize

      34KB

      MD5

      5087cf6d27cd1d262c9d7026d99570a4

      SHA1

      f5939eef20513cf63d86c6b9c0f77b7f2c37db5b

      SHA256

      c2819e8b353a44047aba048d2ed6d004fc5fa7d107055c96e83038690a4c8597

      SHA512

      4f650a6aadaf6d090bdff9e7d21a868365505dabc41de28afe18c651ebc9d5cb391d8f76b51416a4a42d50f5d28a3c0c46eae5c2c549ba3f6f676b3e18b40c3d

    • C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml

      Filesize

      530B

      MD5

      751ba1f9a431ddb7dd5ad2693a642423

      SHA1

      7952264c1bd9d32a73fb17039662f147fe0cf09b

      SHA256

      e9ff2ac66c6736f7e1c64aa828f8eb522f73d715a6870ed6a39f77fc858c81fc

      SHA512

      57cbc62a53b701dd7f86525389fa736f952aa7f7271137bcde86a59012347899e97c86e888d9a879a1e27fe113b860dcf4f9f2820b7e5a19d199fc13c446bbc1

    • C:\Users\Admin\AppData\Local\Temp\omnija-20240004.zip

      Filesize

      40.8MB

      MD5

      dc5128fcb8d7f6b849f1166532db2dc8

      SHA1

      8427501d440d5edbbb2662294bc5650d2bc8aab5

      SHA256

      36e682f419c2b5d8e7c285d36088b56d59df3869dbd181943280696d4ca391ca

      SHA512

      bcf0d463ed4f01a313b8e6be745ad55b42108be84cc5850c411dec19aa7c6d996782da49fc208559f1188941bdd1082d954cfa316f08c0ad2efcf0662952e524

    • C:\Users\Admin\AppData\Local\Temp\vendor00000.xml

      Filesize

      509B

      MD5

      281e659e73e029f83f4d70c3a4133593

      SHA1

      ed83fa8543310d058e038b78285396c534c743d0

      SHA256

      bb4f08a2684d5c9ea18b14f0febbaeef735aeee8c64c0bef827d8ea961930c25

      SHA512

      d0b414ba69460b2ed72a1a937bb3f599ee74816ddbb25e5d894530b42005e8f3faf662b237a26aef500f627685e95e4996d4ab5c64e39e4102c22e0f5b99682a

    • C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi

      Filesize

      9.8MB

      MD5

      43937c99760d32c5bc1133505811d595

      SHA1

      079ae507971b9c19dd6b4b4379defc3227edf978

      SHA256

      af7328aabb530a997c5e8dd39b1ba7c6d28ed756bafc7afde1ae894c28cfd806

      SHA512

      d6b19c9bfc431fba4dc981c09061a00856435736d21485a7d435b9ca132bb752b0cd272eb68f1a30172caf82b371001c626dec08d9a829566ab8a250f92d753f

    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kwvh0l1k.Admin\places.sqlite-20240604010041.025921.backup

      Filesize

      68KB

      MD5

      314cb7ffb31e3cc676847e03108378ba

      SHA1

      3667d2ade77624e79d9efa08a2f1d33104ac6343

      SHA256

      b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1

      SHA512

      dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5

    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20240604010041.104056.backup

      Filesize

      1KB

      MD5

      3adec702d4472e3252ca8b58af62247c

      SHA1

      35d1d2f90b80dca80ad398f411c93fe8aef07435

      SHA256

      2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

      SHA512

      7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20240604010041.104056.backup

      Filesize

      313B

      MD5

      af006f1bcc57b11c3478be8babc036a8

      SHA1

      c3bb4fa8c905565ca6a1f218e39fe7494910891e

      SHA256

      ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

      SHA512

      3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

    • C:\Users\Admin\AppData\Roaming\Yandex\ui

      Filesize

      38B

      MD5

      737dc0fb23bd24be3bdfece43877d2d1

      SHA1

      65d2c6fa8af7d6ddb14a97ef6ebd59e88f1d8fd1

      SHA256

      507c01ac3f5e0bec05599eb0e1c89a00182fe6281340bab01788bcdb44d01f9d

      SHA512

      e1910e39ba0b923513132fd133b04bf201a5b839f27533365d9d82393280bd286236d0d28aa04fd1e106094d528540c1728fcc0c610f6d081778245587187ffa

    • C:\Windows\Installer\MSI1827.tmp

      Filesize

      181KB

      MD5

      0c80a997d37d930e7317d6dac8bb7ae1

      SHA1

      018f13dfa43e103801a69a20b1fab0d609ace8a5

      SHA256

      a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86

      SHA512

      fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5

    • C:\Windows\Installer\MSI1902.tmp

      Filesize

      189KB

      MD5

      e6fd0e66cf3bfd3cc04a05647c3c7c54

      SHA1

      6a1b7f1a45fb578de6492af7e2fede15c866739f

      SHA256

      669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2

      SHA512

      fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb