0df9563014cb59e44dc5035958bc084b027712e0f83ca992d179e21751d2bc24

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

traveldoc4_unpacked.exe
Size

51KB
MD5

0a1ecc15699b43a5d217ec61f9a8d900
SHA1

6d0d4005075a3eacdb5010c01e8e15e11e88adda
SHA256

0df9563014cb59e44dc5035958bc084b027712e0f83ca992d179e21751d2bc24
SHA512

afb4403baff211f6710bb95dc09df83dfafe8b5b224d5f684ed767e1553315abd7b8494c04886cf3c0b6e2d484eb0ee8928e6f1c7d83bc67e1d21bc3fe583cde
SSDEEP

768:NVDz8MMXzk+npS7cBOETqWLTXQuRVmeLJzaZjPLh:Np2k+npS0OETqW/dvzaZHh

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FireFox.url	traveldoc4_unpacked.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2988	traveldoc4_unpacked.exe

C:\Users\Admin\AppData\Local\Temp\traveldoc4_unpacked.exe
"C:\Users\Admin\AppData\Local\Temp\traveldoc4_unpacked.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...