Analysis

  • max time kernel
    143s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-10-2024 21:44

General

  • Target

    Open AI Sora 4.0 Verison 4.89.exe

  • Size

    365KB

  • MD5

    4aca9457933a530c0bf576f7f537694a

  • SHA1

    f39053f92e86885a3cd52ff5630bcbc1cbe4cadf

  • SHA256

    f8380479fe4558dfe5f787f73daa412b7386c045b7d5e8f39d3cb73b5b204569

  • SHA512

    87ddd3fded58ce0d01acad9f6992bd14400c1acb3c29519370b9b628d2fbfd49accb177171649aa39018d05f5fe1f759c78f0c012c9834306efae4e08f0cd9b2

  • SSDEEP

    3072:C5I+ERABhR3JqnP8I+McS9MESlGW1AgCBMNBNsYoh+buYJoY46ZFaVLMxKawbvWw:r/3nvX19MtlGW1AgGO+hqohPaxbw7W

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Open AI Sora 4.0 Verison 4.89.exe
    "C:\Users\Admin\AppData\Local\Temp\Open AI Sora 4.0 Verison 4.89.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Users\Admin\AppData\Local\Temp\app-11.4.0\Open AI Sora 4.0 Verison 4.89.exe
      "C:\Users\Admin\AppData\Local\Temp\app-11.4.0\Open AI Sora 4.0 Verison 4.89.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Stop-Process -Name "msedge"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1508
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Stop-Process -Name "firefox"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:716
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Stop-Process -Name "firefox"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
      • C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe
        "C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    1KB

    MD5

    def65711d78669d7f8e69313be4acf2e

    SHA1

    6522ebf1de09eeb981e270bd95114bc69a49cda6

    SHA256

    aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

    SHA512

    05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    17KB

    MD5

    9440f316533f70e7b4d3cdb8df05d743

    SHA1

    7a4949aac188063d3f1a207172b0503c088d0c94

    SHA256

    e0a6ef97c0561bf90f0eb7da03f24deb6e98dca78e62f801ab805f77ca71e551

    SHA512

    5dd59e6f01a096afddb99effa84090b87f2a0bdbef26950175b79cb0326b371795f8859d4fe63abe0168d66aa7ba22858ef3ec19e7ed733ccc23737872a62ca0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    17KB

    MD5

    7667c3d7a664de4b675fd1f790f84ffa

    SHA1

    87e4b175a4e52737dc21a1e40df44c6a665197ac

    SHA256

    1e7492aa72914f144ed015350595ad0e8887e19a966d76eebb73722851fa77f4

    SHA512

    2c1cd7bc55616e27d7562727898f93df931a6fb0037c36d28eec55b2816de534603184429f30be8c06dad462f39775ebbdbcc4459447ed701eb2245a64af9f02

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sqzzgx5s.mb2.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/716-194-0x00000000738D0000-0x0000000074080000-memory.dmp

    Filesize

    7.7MB

  • memory/716-191-0x0000000005D70000-0x00000000060C4000-memory.dmp

    Filesize

    3.3MB

  • memory/716-181-0x00000000738D0000-0x0000000074080000-memory.dmp

    Filesize

    7.7MB

  • memory/716-180-0x00000000738D0000-0x0000000074080000-memory.dmp

    Filesize

    7.7MB

  • memory/716-179-0x00000000738D0000-0x0000000074080000-memory.dmp

    Filesize

    7.7MB

  • memory/1508-163-0x0000000006B00000-0x0000000006B1A000-memory.dmp

    Filesize

    104KB

  • memory/1508-159-0x0000000006050000-0x00000000063A4000-memory.dmp

    Filesize

    3.3MB

  • memory/1508-164-0x0000000006B70000-0x0000000006B92000-memory.dmp

    Filesize

    136KB

  • memory/1508-142-0x00000000738DE000-0x00000000738DF000-memory.dmp

    Filesize

    4KB

  • memory/1508-162-0x00000000078B0000-0x0000000007946000-memory.dmp

    Filesize

    600KB

  • memory/1508-161-0x0000000006680000-0x00000000066CC000-memory.dmp

    Filesize

    304KB

  • memory/1508-160-0x0000000006630000-0x000000000664E000-memory.dmp

    Filesize

    120KB

  • memory/1508-165-0x0000000007F00000-0x00000000084A4000-memory.dmp

    Filesize

    5.6MB

  • memory/1508-168-0x00000000738D0000-0x0000000074080000-memory.dmp

    Filesize

    7.7MB

  • memory/1508-149-0x0000000005FE0000-0x0000000006046000-memory.dmp

    Filesize

    408KB

  • memory/1508-148-0x0000000005F70000-0x0000000005FD6000-memory.dmp

    Filesize

    408KB

  • memory/1508-147-0x0000000005680000-0x00000000056A2000-memory.dmp

    Filesize

    136KB

  • memory/1508-146-0x00000000738D0000-0x0000000074080000-memory.dmp

    Filesize

    7.7MB

  • memory/1508-145-0x0000000005750000-0x0000000005D78000-memory.dmp

    Filesize

    6.2MB

  • memory/1508-144-0x00000000738D0000-0x0000000074080000-memory.dmp

    Filesize

    7.7MB

  • memory/1508-143-0x0000000005080000-0x00000000050B6000-memory.dmp

    Filesize

    216KB

  • memory/2484-59-0x000000002E1E0000-0x000000002E21C000-memory.dmp

    Filesize

    240KB

  • memory/2484-63-0x000000002E3C0000-0x000000002E3D2000-memory.dmp

    Filesize

    72KB

  • memory/2484-31-0x000000002DF70000-0x000000002E015000-memory.dmp

    Filesize

    660KB

  • memory/2484-56-0x000000002E1E0000-0x000000002E21C000-memory.dmp

    Filesize

    240KB

  • memory/2484-48-0x000000002E3F0000-0x000000002E486000-memory.dmp

    Filesize

    600KB

  • memory/2484-28-0x000000002DF70000-0x000000002E015000-memory.dmp

    Filesize

    660KB

  • memory/2484-27-0x000000002E540000-0x000000002E896000-memory.dmp

    Filesize

    3.3MB

  • memory/2484-20-0x0000000006B40000-0x0000000006B70000-memory.dmp

    Filesize

    192KB

  • memory/2484-35-0x0000000007090000-0x00000000070A5000-memory.dmp

    Filesize

    84KB

  • memory/2484-36-0x00000000070B0000-0x00000000070C1000-memory.dmp

    Filesize

    68KB

  • memory/2484-39-0x00000000070B0000-0x00000000070C1000-memory.dmp

    Filesize

    68KB

  • memory/2484-40-0x000000002E260000-0x000000002E2D5000-memory.dmp

    Filesize

    468KB

  • memory/2484-43-0x000000002E260000-0x000000002E2D5000-memory.dmp

    Filesize

    468KB

  • memory/2484-44-0x000000002E2E0000-0x000000002E334000-memory.dmp

    Filesize

    336KB

  • memory/2484-47-0x000000002E2E0000-0x000000002E334000-memory.dmp

    Filesize

    336KB

  • memory/2484-55-0x000000002E340000-0x000000002E3BA000-memory.dmp

    Filesize

    488KB

  • memory/2484-60-0x000000002E3C0000-0x000000002E3D2000-memory.dmp

    Filesize

    72KB

  • memory/2484-32-0x0000000007090000-0x00000000070A5000-memory.dmp

    Filesize

    84KB

  • memory/2484-64-0x000000002E040000-0x000000002E046000-memory.dmp

    Filesize

    24KB

  • memory/2484-0-0x00000000070D0000-0x0000000007A59000-memory.dmp

    Filesize

    9.5MB

  • memory/2484-52-0x000000002E340000-0x000000002E3BA000-memory.dmp

    Filesize

    488KB

  • memory/2484-51-0x000000002E3F0000-0x000000002E486000-memory.dmp

    Filesize

    600KB

  • memory/2484-19-0x000000002E050000-0x000000002E1DE000-memory.dmp

    Filesize

    1.6MB

  • memory/2484-24-0x000000002E540000-0x000000002E896000-memory.dmp

    Filesize

    3.3MB

  • memory/2484-23-0x0000000006B40000-0x0000000006B70000-memory.dmp

    Filesize

    192KB

  • memory/2484-16-0x000000002E050000-0x000000002E1DE000-memory.dmp

    Filesize

    1.6MB

  • memory/2484-5-0x0000000006B70000-0x0000000006C17000-memory.dmp

    Filesize

    668KB

  • memory/2484-8-0x0000000006B70000-0x0000000006C17000-memory.dmp

    Filesize

    668KB

  • memory/2484-12-0x0000000006A40000-0x0000000006A68000-memory.dmp

    Filesize

    160KB

  • memory/2484-15-0x0000000006A40000-0x0000000006A68000-memory.dmp

    Filesize

    160KB

  • memory/2484-9-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2484-4-0x00000000012F4000-0x00000000012F5000-memory.dmp

    Filesize

    4KB

  • memory/2484-3-0x00000000070D0000-0x0000000007A59000-memory.dmp

    Filesize

    9.5MB

  • memory/2492-196-0x0000000005A60000-0x0000000005DB4000-memory.dmp

    Filesize

    3.3MB