5ad39be48dbd64accc2e81e8bcb4f65325fc119f283713ca5aa677869398c580

General

Target

SyncSpoofer.exe
Size

2.5MB
Sample

240727-wg178svcld
MD5

4c23a05e5ee3cbf9f770a04c434faead
SHA1

67bdadebdd222beae7097bbed9699aaf18282657
SHA256

5ad39be48dbd64accc2e81e8bcb4f65325fc119f283713ca5aa677869398c580
SHA512

ac46de9bb81356d35f4b4cc930d7c934ebc9ac1578d93291d15540c44588985ce8a1479cd790b4318595609e7d392938c1345256eb889cf071e5d0b8cbe0f232
SSDEEP

49152:jLTbqRkki0qgd0fsexLxZak//s3RA+SW4+VbuLpG8AVTyyu75jNi7MOZTFL:HaoDgw7aTB4W4+VgG8QTyrFJ8rNB

Score

10^/10

Malware Config

Targets

- Target
  
  SyncSpoofer.exe
- Size
  
  2.5MB
- MD5
  
  4c23a05e5ee3cbf9f770a04c434faead
- SHA1
  
  67bdadebdd222beae7097bbed9699aaf18282657
- SHA256
  
  5ad39be48dbd64accc2e81e8bcb4f65325fc119f283713ca5aa677869398c580
- SHA512
  
  ac46de9bb81356d35f4b4cc930d7c934ebc9ac1578d93291d15540c44588985ce8a1479cd790b4318595609e7d392938c1345256eb889cf071e5d0b8cbe0f232
- SSDEEP
  
  49152:jLTbqRkki0qgd0fsexLxZak//s3RA+SW4+VbuLpG8AVTyyu75jNi7MOZTFL:HaoDgw7aTB4W4+VgG8QTyrFJ8rNB
Score

10^/10

credential_access defense_evasion discovery evasion execution persistence spyware stealer
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2