a32a062140aeb97aa3db013a4dee11729bc9fd2f2cac9d24d23e1809fea0446c

Analysis

max time kernel
80s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02-09-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/node-notifier/vendor/snoreToast/snoretoast-x86.exe
Size

2.0MB
MD5

f169b8fe7736d10e44a0181d7a3e8e26
SHA1

232848dbd8cdf91b1771d1fdc92bebb80d706441
SHA256

3685549715409113ff00e5b7aef77e6be758723c35910807c01e9f8e4d757a45
SHA512

88d997fb965f6397e58feea5c17d4df997c5a15a43c113acd3e97a45233d44f82d5a41e477c2692fcd1bcc6ce12f5e10ba7a5e5e25db243ba5c35e668616082a
SSDEEP

49152:M3cbOgvxzNFUqxAhYyYDjGfoBbEQk+03wzqgCNLuLy:F38

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snoretoast-x86.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\WOW6432Node\CLSID	snoretoast-x86.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\WOW6432Node\CLSID\{eb1fdd5b-8f70-4b5a-b230-998a2dc19303}	snoretoast-x86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\WOW6432Node\CLSID\{eb1fdd5b-8f70-4b5a-b230-998a2dc19303}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\resources\\app.asar.unpacked\\node_modules\\node-notifier\\vendor\\snoreToast\\snoretoast-x86.exe"	snoretoast-x86.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\WOW6432Node\CLSID\{eb1fdd5b-8f70-4b5a-b230-998a2dc19303}\LocalServer32	snoretoast-x86.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\WOW6432Node	snoretoast-x86.exe

C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-notifier\vendor\snoreToast\snoretoast-x86.exe
"C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-notifier\vendor\snoreToast\snoretoast-x86.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads