c0ea4bedcce6ebff557298ae4015a010af1fc7e9dc5b40670b441c1a66f42de8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
18/06/2024, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ByteFence.exe
Size 3.8MB
Sample240618-sy6mhatepk
SHA256 16e0d6966e98794aa18719606e41f4d4ae74683d652e81374717282fc8b3239e
MD5 b821cd61e2d66b1ca5c795230f6b1b8e
SHA1 a2e0cea3af916f98233ad73992cbac1dea55b234
SHA512 6f88f403aadb97612bb409bae098bfba28d863a97c4fdb5a69431732251d7a91d3bc76750d30e30db38df1e7d4cf2f633c2b5a09cfef08437d5d1a6cfd55ebd7
SSDEEP 98304:YXrXAQnL22v90UxMwbV1J29H0SF8A9q4er:YTL2mewhn2ddrur
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ByteFence.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\f:	ByteFence.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ByteFenceService.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan\ = "Scan with ByteFence Anti-Malware..."	ByteFence.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan\Position = "Middle"	ByteFence.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan\command	ByteFence.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ByteFence File Scan\Position = "Middle"	ByteFence.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ByteFence File Scan\command	ByteFence.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ByteFence File Scan\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ByteFenceScan.exe\" /scan:\"%1\""	ByteFence.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan	ByteFence.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ByteFence.exe\",0"	ByteFence.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ByteFenceScan.exe\" /scan:\"%1\""	ByteFence.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ByteFence File Scan	ByteFence.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ByteFence File Scan\ = "Scan with ByteFence Anti-Malware..."	ByteFence.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ByteFence File Scan\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ByteFence.exe\",0"	ByteFence.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
1952	ByteFence.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
744	ByteFenceService.exe
744	ByteFenceService.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	ByteFence.exe
Token: SeDebugPrivilege	4548	ByteFenceService.exe
Token: SeDebugPrivilege	744	ByteFenceService.exe
Token: SeDebugPrivilege	744	ByteFenceService.exe
Token: SeDebugPrivilege	744	ByteFenceService.exe
Token: SeBackupPrivilege	744	ByteFenceService.exe
Token: SeRestorePrivilege	744	ByteFenceService.exe
Token: SeLoadDriverPrivilege	744	ByteFenceService.exe
Token: SeDebugPrivilege	1952	ByteFence.exe
Token: SeDebugPrivilege	1952	ByteFence.exe
Token: SeBackupPrivilege	1952	ByteFence.exe
Token: SeRestorePrivilege	1952	ByteFence.exe
Token: SeLoadDriverPrivilege	1952	ByteFence.exe
Token: SeBackupPrivilege	1164	dw20.exe
Token: SeBackupPrivilege	1164	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4548	1952	ByteFence.exe	84
PID 1952 wrote to memory of 4548	1952	ByteFence.exe	84
PID 1952 wrote to memory of 1164	1952	ByteFence.exe	88
PID 1952 wrote to memory of 1164	1952	ByteFence.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ByteFence.exe
"C:\Users\Admin\AppData\Local\Temp\ByteFence.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952
- \??\c:\users\admin\appdata\local\temp\ByteFenceService.exe
  "c:\users\admin\appdata\local\temp\ByteFenceService.exe" /i
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 2248
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1164

\??\c:\users\admin\appdata\local\temp\ByteFenceService.exe
"c:\users\admin\appdata\local\temp\ByteFenceService.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

err.dat

Path C:\Users\Admin\AppData\Local\Temp\Logs\err.dat
Size 5KB
SHA256 2e8ca2b067014eec0f5f8491ac4af932ac569176f9d723b4c6bd6d920d0e21e5
MD5 2d5d791bb79e7c19034fc09ef5b9c36a
SHA1 fe624f7ee86d3537adeeecd85c68d67952dd0957
SHA512 5237af2a39c9e470292e396e0057fbbdcd1e9934b669aa9a3399c9d03d1452c521fb01f370003952a40e78206846af21aa436bba0dddaf8a163862f77d21f78e
SSDEEP 96:vp2t1pAIpow9pAIpowHpkIpMwrpFZ0DQplDQpyQ3pOIpEwSwpNIpmw7pMIp0w20:vp2t1pAIpow9pAIpowHpkIpMwrpFiDQZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Errors.dat

Path \??\c:\users\admin\appdata\local\temp\Errors.dat
Size 4KB
SHA256 b698eaffe9a060f5b447e27ff1b15ea635da6324a22618b102991615e9e15c8f
MD5 57714ea5abb34db2c79a52f14a683a02
SHA1 8dbb7a345904b5411393a1fafc22c6d895c8e3ce
SHA512 10ef89ff30a0b228d431e89df8e22690de7c13f20a3f9105984164471df619188458d27f4c7b621acc7c9bce5238ebe5f510fe07b2330ae86d075f123d12429b
SSDEEP 96:tlBGmnH6uMt3gwfgwJgwNZ0DkD8egwSggwdgw2Igwdkx04:t28Mt3gwfgwJgwNiDkD8egwbgwdgw1gd
MD5 SHA1 SHA512 SSDEEP

Submit Download

err.dat

Path \??\c:\users\admin\appdata\local\temp\Logs\err.dat
Size 7KB
SHA256 f111b0aa5b4367e33fe4036f999bef3fa255c8fd7458bdb682c0cd2b57cd55ed
MD5 b140b553dcc64b86784eb21bfef62841
SHA1 ad5eb6efa778c2e98a8c0fae74385769d96dcd57
SHA512 aaf21ac611dfe32c039a5728aba4f0002f602af8aa83010e124aff4b81b06ecda0db5b260dfbf182298a1cb6969761a2fa49ea7a857c398eb3d2a23a29c4a64d
SSDEEP 192:vp2t1pAIpow9pAIpowHpkIpMwrpFiDQplDQpy+pOIpEwppNIpmw7pMIp0wTp4IpS:hmDokDoGPMAFSY9Y39EwKmmH0KrA6e8q
MD5 SHA1 SHA512 SSDEEP

Submit Download

rsEngine.config

Path \??\c:\users\admin\appdata\local\temp\rsEngine.config
Size 344B
SHA256 d71574e62332c8ba76faf56f14de7357b6b2eba1d6c2e41dd140170a7b729d50
MD5 56471e1d552cf365892a221059747376
SHA1 89cb5955b2ea777edd6366c5139029946310bafd
SHA512 a5be82b7a7940a60e5febf5458237fcfa4b1a06188604529089b711b802c0fee7bad700a368830737e78d0c32431cc8baa13cb65f1c320cf14943be7d8e46972
MD5 SHA1 SHA512

Submit Download

memory/744-47-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/744-121-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/744-56-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/744-52-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/744-49-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/744-48-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-78-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-57-0x000000001C760000-0x000000001C7CA000-memory.dmp

Download

memory/1952-1-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-2-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-3-0x000000001CC50000-0x000000001D1A4000-memory.dmp

Download

memory/1952-120-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-4-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-99-0x0000000023250000-0x0000000023386000-memory.dmp

Download

memory/1952-94-0x0000000021B90000-0x0000000021BC6000-memory.dmp

Download

memory/1952-93-0x0000000021B00000-0x0000000021B44000-memory.dmp

Download

memory/1952-10-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-9-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-8-0x000000001C030000-0x000000001C06C000-memory.dmp

Download

memory/1952-50-0x00007FFE830A5000-0x00007FFE830A6000-memory.dmp

Download

memory/1952-51-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-7-0x000000001BF90000-0x000000001C02C000-memory.dmp

Download

memory/1952-55-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-6-0x000000001E500000-0x000000001E9CE000-memory.dmp

Download

memory/1952-5-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-13-0x000000001C2A0000-0x000000001C2C0000-memory.dmp

Download

memory/1952-61-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-62-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-60-0x000000001FA00000-0x000000001FA08000-memory.dmp

Download

memory/1952-63-0x000000001EF10000-0x000000001EF62000-memory.dmp

Download

memory/1952-64-0x000000001BBD0000-0x000000001BBD6000-memory.dmp

Download

memory/1952-65-0x0000000020820000-0x000000002099C000-memory.dmp

Download

memory/1952-0-0x00007FFE830A5000-0x00007FFE830A6000-memory.dmp

Download

memory/1952-79-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/1952-84-0x00000000217B0000-0x0000000021812000-memory.dmp

Download

memory/1952-89-0x0000000021820000-0x0000000021860000-memory.dmp

Download

memory/4548-46-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/4548-22-0x000000001C1D0000-0x000000001C1F4000-memory.dmp

Download

memory/4548-19-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/4548-18-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/4548-17-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/4548-16-0x0000000000FB0000-0x0000000000FC8000-memory.dmp

Download

memory/4548-15-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download

memory/4548-14-0x00007FFE82DF0000-0x00007FFE83791000-memory.dmp

Download