a32a062140aeb97aa3db013a4dee11729bc9fd2f2cac9d24d23e1809fea0446c

Analysis

max time kernel
83s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02-09-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/node-notifier/vendor/snoreToast/snoretoast-x64.exe
Size

2.4MB
MD5

e08da369f21959907289ed78fc29974f
SHA1

a2213b258524db4aed800ad79ba9e1dd93d09061
SHA256

b92c8e0e52790057b8798b5c7ebf2fda87d7273fd277615cc75c5bf9db42db20
SHA512

16a5dd1265bdc5e540a06f64487f20f27ed5cd0e574ba7dea649480337a075b19119df0781764fd2321c3838bf1a19efdeb030b5912399a61baace8d1dc482a2
SSDEEP

24576:pseqxWIYNkLJF5qxX3FBkBwAn1cipJjog:6Zb3XgX1B6wi1cOV

Score

5^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\CLSID\{eb1fdd5b-8f70-4b5a-b230-998a2dc19303}	snoretoast-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\CLSID\{eb1fdd5b-8f70-4b5a-b230-998a2dc19303}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\resources\\app.asar.unpacked\\node_modules\\node-notifier\\vendor\\snoreToast\\snoretoast-x64.exe"	snoretoast-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\CLSID\{eb1fdd5b-8f70-4b5a-b230-998a2dc19303}\LocalServer32	snoretoast-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\CLSID	snoretoast-x64.exe

C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-notifier\vendor\snoreToast\snoretoast-x64.exe
"C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-notifier\vendor\snoreToast\snoretoast-x64.exe"
1⤵
- Modifies registry class
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads