ff49326dcd45aa48f91c8c95cd915ac672c9b98d1adb32fa29648fd8eef815cc

Analysis

max time kernel
134s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

use_2024_tо_оpen/Sеtup.exe
Size

2.5MB
MD5

2cca9b25e6ed5a9f606d880ab6c95cb7
SHA1

fe5c91f7417da470a4379a15c526225ea3156b9f
SHA256

339fe7bdfbe4212886cc8582655b83f5d2ee08c33939fa331447e7ee1ddf0d0b
SHA512

319ea2bee3b8b0dd69460079b3c3201210f79649e30c47d7bba87f38569c3e245cb3f01694465a9eb003530e5b38d4a7ebd980ecdf977160457cb81bea09b5a8
SSDEEP

49152:Ungy9PBYGZ6tsa/67rrcSYQ/udHEVbeGfYeZD6k5M:ho/udHEVbeiRHS

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Sеtup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Sеtup.exe

C:\Users\Admin\AppData\Local\Temp\use_2024_tо_оpen\Sеtup.exe
"C:\Users\Admin\AppData\Local\Temp\use_2024_tо_оpen\Sеtup.exe"
1⤵
- Checks processor information in registry
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3152-0-0x0000000000400000-0x0000000000D48000-memory.dmp

Filesize
9.3MB

Download
memory/3152-1-0x0000000000400000-0x0000000000D48000-memory.dmp

Filesize
9.3MB

Download