Resubmissions
07-10-2024 05:31
241007-f76bwasdpf 807-10-2024 03:45
241007-ebh12axgna 807-10-2024 03:41
241007-d88ghsxflg 807-10-2024 03:38
241007-d7bfdstbkm 8Analysis
-
max time kernel
149s -
max time network
71s -
platform
windows7_x64 -
resource
win7-20240729-ja -
resource tags
-
submitted
07-10-2024 03:45
General
-
Target
vTHGfiwMDeoOH5a.exe
-
Size
785KB
-
MD5
3aa5992e9a518e4d1a7042a16b10e31d
-
SHA1
5bce77192abbf2a71a2b19d6b00f08685f569b64
-
SHA256
cfad352d8c9e907269c76b22b73f7a9fa47c3782c99ec48598a310a35d3bdaac
-
SHA512
518b38137a320e3853e28496485c04c933b68ef34f4ef9b4da363711555ea70c11325d4e05d761d5a4aaa199e684e0da084e0226f319cfe3a29dc00d120fed95
-
SSDEEP
24576:A0ixK9bqAGf89ojqUk6fT6xuBgptr6svn6v:9ixKp5NX6BBStr6svnu
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of SetThreadContext 6 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 20 IoCs
-
Suspicious use of WriteProcessMemory 45 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" C:\Windows\system32\taskschd.msc2⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4fc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
438KB
MD59ec4d0fe38cb4de94d578bfd72c8eebd
SHA1e316282a617c5f0c40c488de79c73cf13c8baaf2
SHA2562402c65692d0a822d7931489d1bbf29fa9bfbf210819c1614dd8d2350e747f2f
SHA512a3d1ff3c516cf2c6548e03d68eeaff530acc794e1f76253d46b092183bd762c1126160dd611e0d3ceec5d0664d946e5d154b8dc88b1bccf606b57cfd59a31201
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
5KB
MD5cd9b704b328573406d319f6e22e043be
SHA1fb88536357cf2a7db522684887affd85ab5747da
SHA2568274a340b59d469c27eb238a7984d250287c7820556a9e2693e8f1ecd907936a
SHA512869ac4a65380ec36254de7309d84d5c98d4b280e71bdcc389f4689bc140ef86ea0eb3e736cb7e906417e40eba79c33dd712cf67099ae26ffeecff78130e2ca29
-
Filesize
7KB
MD59e2111efd6b1b933bf1b9c1211bf8545
SHA16590f4e3ab461838f99ea2438809d07a7641e6da
SHA2567bc33a190d4f6a6a1560afaf5130422399eda0fa6b6ca086012a6e6e81a37720
SHA5126c23e2bca284854ab50f8a07dccf29cb84f46438765c45e501bd659c5ab22d3d0e0649d83ee41e760e35032fa8cf381f815a908424b2371d5f259cdd3bfe74bb
-
Filesize
837KB
MD5e1b58e0aa1b377a1d0e940660ad1ace1
SHA15afc7291b26855b1252b26381ebc85ed3cca218f
SHA2561b98c006231d38524e2278a474c49274fe42e0bb1a31bcfda02e6e32f559b777
SHA5129ce778bcb586638662b090910c4ceab3b64e16dfaf905a7581c1d349fecdf186995b3cc0dc8c6fc6e9761ea2831d7b14ac1619c2bd5ebc6d18015842e5d94aa2
-
Filesize
1024KB
-
Filesize
840KB
-
Filesize
808KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
96KB
-
Filesize
568KB
-
Filesize
6.9MB
-
Filesize
808KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
760KB
-
Filesize
272KB
-
Filesize
760KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
1.7MB
-
Filesize
32KB
-
Filesize
3.3MB
-
Filesize
56KB
-
Filesize
352KB
-
Filesize
120KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
4KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB