9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f

Analysis

max time kernel
125s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f.exe
Size

17KB
MD5

d9bb8e2485021f29bad3e9b116c5d936
SHA1

0933660c4c3299d7da4329d40229d9d6221c7063
SHA256

9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f
SHA512

be55bf763f2df783abf2de193d3ae3b664145c7e5c97efd6e779adb4ecf2ec72696422e28596ea1d022abb6a52c2afe95be9ef56e670257f1519b7d845a5f404
SSDEEP

384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/peQ:IMAQ+BzWPEwnE+KHM2/p5

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1996	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f.exe
Token: SeDebugPrivilege	1996	svhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 1996	3184	9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f.exe	89
PID 3184 wrote to memory of 1996	3184	9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f.exe	89
PID 3184 wrote to memory of 1996	3184	9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f.exe	89

C:\Users\Admin\AppData\Local\Temp\9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f.exe
"C:\Users\Admin\AppData\Local\Temp\9f95a59fdd7401bcde8f9e02215a1152720bea72fca7f2e6520046406327c62f.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4056,i,7252135083366563450,1411796122645726339,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
338KB

MD5
8fb08970197cf6e1b19c4b9f657efad4

SHA1
8bd914860ccc49487bc0db162ee30ff44572c308

SHA256
9e6d7fc9d106db0bbf377e1b1de2e5de988b70f52d6d56105f2a7db63b6e138a

SHA512
1ac45bb6c1acfa1ada6316ebe2d5c86d5d7e108eee5205a02791d1ae50eaabc2c8530731e0aae9d163f5d004ea1ab251904e7864b1b79dcf61f87a9c48a06634

Download Submit
C:\Users\Admin\AppData\Local\Temp\2rY7dWfrAYSuITj.exe

Filesize
17KB

MD5
4de5aaa7c48701dce55e2a4f088be696

SHA1
b42d2a32f54ee7f18032da7663faf527df4daa02

SHA256
0e8bc4e6fb72fefa3f8142fb94c8ce207bc44ccc65f62fb7b21dd4fd09ed210f

SHA512
184ec348c1c022c9983ae3be641a9749ec2a4a1f1c9025a7ccd83551585b4cfbaab28d54b9fb58579964f3b8a5faab9414d684117ae3f156191fd6f593584cfb

Download Submit
C:\Windows\svhost.exe

Filesize
16KB

MD5
76fd02b48297edb28940bdfa3fa1c48a

SHA1
bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

SHA256
07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

SHA512
28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads