Analysis

  • max time kernel
    116s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 22:26

General

  • Target

    c85619aa2e2ee33fa3a7f4439a95052039688a448fe2337950fcc16550d952bb.exe

  • Size

    644KB

  • MD5

    66a8ffb4677901d3ebc3fe840ac85c22

  • SHA1

    120610126ae00c2b2cd174feb5f843d44e1baf7e

  • SHA256

    c85619aa2e2ee33fa3a7f4439a95052039688a448fe2337950fcc16550d952bb

  • SHA512

    70d36848912b6530b89341636d0b99381b8ad5770639b58f010006a49bf8302a59f27916850596e2c0501d032cec3dd4a107233bdd75bac687a6d8b98a4ce6a6

  • SSDEEP

    12288:12mwwhVKvAPMHfyxNrUEqjaBJgFJwQ/1QR8dMc+ty5xXSQpHc9noZvzqgyVTnKd4:1++cf0NrUn88Jw5+GceY4S89OetVTKd4

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c85619aa2e2ee33fa3a7f4439a95052039688a448fe2337950fcc16550d952bb.exe
    "C:\Users\Admin\AppData\Local\Temp\c85619aa2e2ee33fa3a7f4439a95052039688a448fe2337950fcc16550d952bb.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2720

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2720-0-0x0000000000400000-0x00000000005AC000-memory.dmp

          Filesize

          1.7MB

        • memory/2720-2-0x000000006F2E0000-0x000000006F2F0000-memory.dmp

          Filesize

          64KB

        • memory/2720-21-0x0000000000400000-0x00000000005AC000-memory.dmp

          Filesize

          1.7MB

        • memory/2720-24-0x0000000000400000-0x00000000005AC000-memory.dmp

          Filesize

          1.7MB