Analysis
-
max time kernel
110s -
max time network
113s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
-
submitted
14/07/2024, 21:31
General
-
Target
System.scr
-
Size
183KB
-
MD5
7d17713fc862d6a8e99d21886724b326
-
SHA1
ecc9378bfe46d03d4c9cfe3ca5e064e93712644c
-
SHA256
d5feaa594c1402ac14cf911dbe520b2d5670b732d8203c3fd035d96483c605fa
-
SHA512
8953fec9e3d1248fd8fade518de35c17233ebbdab2f9d2b899203c54a92db76f9aef62a209342fbec00667179105ffbbcae00aee35020119609bceb451bcfef2
-
SSDEEP
3072:SurlxKc8HZde2vBVQF4EWjFRA229YvepcCBKX/p6:hrl8deAVQF4EWx92iepcCBKv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\System.scr"C:\Users\Admin\AppData\Local\Temp\System.scr" /S1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows\System.exe"C:\Users\Admin\AppData\Roaming\Windows\System.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44B
MD5f6cc26c8de4d73281a6648d65560678e
SHA190220c982ff30ab822bfa0cc790b4e74604d9dd1
SHA2562ecdc7857187ed701cd6166d5a81c05a1e1ed2f585cf89d3319a9a9bd90ee886
SHA512ed90074aa7674585558335015aeaa504420e1c4c2a5708634c31497fcc44aa8eb4270cc00207fd7672e34ea3263adc43461c9f9a705cc9161db7b7d8538df969
-
Filesize
183KB
MD57d17713fc862d6a8e99d21886724b326
SHA1ecc9378bfe46d03d4c9cfe3ca5e064e93712644c
SHA256d5feaa594c1402ac14cf911dbe520b2d5670b732d8203c3fd035d96483c605fa
SHA5128953fec9e3d1248fd8fade518de35c17233ebbdab2f9d2b899203c54a92db76f9aef62a209342fbec00667179105ffbbcae00aee35020119609bceb451bcfef2
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
392KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
3.1MB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
624KB