Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 13:36

General

  • Target

    7551f8e5bc6d55765b77fed8c1314a7f2bb82cfa9ad65a6d7813995f99127ce6.exe

  • Size

    2.6MB

  • MD5

    68e98791fa420b084c5e7d4cdd16ed7d

  • SHA1

    970c20541e3ee2ec3de16246dbac32622a432734

  • SHA256

    7551f8e5bc6d55765b77fed8c1314a7f2bb82cfa9ad65a6d7813995f99127ce6

  • SHA512

    ee64fdefb3646135f7696dbd26ec9dfa05ce885863ddc3e2c5b2d5a872770b81227e827e47e2e101618d61123196a4ece3921038f3025fb7e2e8a6f6fdb11adb

  • SSDEEP

    49152:gA81IJPUqnEvdDqnroHOfmlO2tiToyGxgMHO:gA81IZgcnsHOm46iToyslH

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7551f8e5bc6d55765b77fed8c1314a7f2bb82cfa9ad65a6d7813995f99127ce6.exe
    "C:\Users\Admin\AppData\Local\Temp\7551f8e5bc6d55765b77fed8c1314a7f2bb82cfa9ad65a6d7813995f99127ce6.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\7551f8e5bc6d55765b77fed8c1314a7f2bb82cfa9ad65a6d7813995f99127ce6.exe
      "C:\Users\Admin\AppData\Local\Temp\7551f8e5bc6d55765b77fed8c1314a7f2bb82cfa9ad65a6d7813995f99127ce6.exe" Master
      2⤵
      • Drops file in Drivers directory
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2092-2-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2092-5-0x0000000000400000-0x000000000069F000-memory.dmp

    Filesize

    2.6MB

  • memory/2092-8-0x0000000000400000-0x000000000069F000-memory.dmp

    Filesize

    2.6MB

  • memory/2236-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2236-1-0x0000000000400000-0x000000000069F000-memory.dmp

    Filesize

    2.6MB