7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf

Analysis

max time kernel
124s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe
Size

80KB
MD5

e6244b27a2520320c9a10568abb79543
SHA1

75bfb745f97fe2a0192431fda3cddf63b306c55a
SHA256

7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf
SHA512

49a45a9809d6a2f68400d061aac5bb218fbadb30420b54cffcc8c77dff99c63ad105a5a572320d88ffb99f2297bf3ba4b95b4876fdf4455a220331950912ac91
SSDEEP

1536:t3x85+Ks2Y8w+tu7Q3+xZd29aPJxk450vyuBVOWG6J11z7fF:th85+Ksb8Fo7QcYAb5y9BVz37F

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1912	TPeCUEYu9wI3bvA.exe
4816	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe
Token: SeDebugPrivilege	4816	svhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1912	2196	7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe	90
PID 2196 wrote to memory of 1912	2196	7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe	90
PID 2196 wrote to memory of 1912	2196	7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe	90
PID 2196 wrote to memory of 4816	2196	7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe	91
PID 2196 wrote to memory of 4816	2196	7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe	91
PID 2196 wrote to memory of 4816	2196	7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe	91

C:\Users\Admin\AppData\Local\Temp\7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe
"C:\Users\Admin\AppData\Local\Temp\7ae39792b9e27976f2b0f3f355e7bd150bf9075f7dc3d4a81f4afb19470e85bf.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\TPeCUEYu9wI3bvA.exe
  C:\Users\Admin\AppData\Local\Temp\TPeCUEYu9wI3bvA.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3852,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
339KB

MD5
7eb9667fb735598961d6645be5b2221f

SHA1
ed3bfa59f5f0bc1352752bc7a7741ea863434cd8

SHA256
38606035f71f809c41b8965ead0805027d393b5289bac8b255649699911d77a5

SHA512
33444bd1aff2491d74dc423134e1e13628f12e0f54895a01fd25bbb4bd8d82d1eecc41cb70d6311c473f615d1b8b1cbbb8601f51efde2ae69828d1818e30d064

Download Submit
C:\Users\Admin\AppData\Local\Temp\TPeCUEYu9wI3bvA.exe

Filesize
64KB

MD5
ae6ce17005c63b7e9bf15a2a21abb315

SHA1
9b6bdfb9d648fa422f54ec07b8c8ea70389c09eb

SHA256
4a3387a54eeca83f3a8ff1f5f282f7966c9e7bfe159c8eb45444cab01b3e167e

SHA512
c883a5f599540d636efc8c0abc05aab7bad0aa1b10ab507f43f18e0fba905a10b94ff2f1ba10ae0fee15cc1b90a165a768dc078fda0ac27474f0eef66f6a11af

Download Submit
C:\Windows\svhost.exe

Filesize
16KB

MD5
76fd02b48297edb28940bdfa3fa1c48a

SHA1
bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

SHA256
07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

SHA512
28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads