Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-10-2024 18:32

General

  • Target

    039d48320a3edaf1db8a2a8b2d5b9ef5097959fedeb8b904267fc32b1c0061e2.exe

  • Size

    1.8MB

  • MD5

    06c3b75deae102144ec995312d6d208a

  • SHA1

    9d7386202e4012460553e792beaa4c1820cf7d17

  • SHA256

    039d48320a3edaf1db8a2a8b2d5b9ef5097959fedeb8b904267fc32b1c0061e2

  • SHA512

    75c6b6c541d078e6374f0212929b20a57b0c9e6772f002dfb3d6eb86f7611bec36b115b3932d8b826c06e0183c77f5980ffe0dcbe7067f4208d91dd8aa3ada0f

  • SSDEEP

    49152:SiDHNvsmt3qmLC26/59I+HV7CjfM6ZAMZnWMsKoIyW5hbh9CQEEOUwnZvAks:/HZ/Cd5u+HVh

Malware Config

Signatures

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 58 IoCs
  • Drops file in Program Files directory 37 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\039d48320a3edaf1db8a2a8b2d5b9ef5097959fedeb8b904267fc32b1c0061e2.exe
    "C:\Users\Admin\AppData\Local\Temp\039d48320a3edaf1db8a2a8b2d5b9ef5097959fedeb8b904267fc32b1c0061e2.exe"
    1⤵
    • Drops Chrome extension
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2072
  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:216
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4192
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2220
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    • Windows security modification
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:768
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:2900
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4668
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

    Filesize

    2.1MB

    MD5

    1d4688d73b16c0041d5376ae240dd972

    SHA1

    b374969fd3bd61354bd3845b3b205dde27bdb5bb

    SHA256

    9f9112661f4cd620e16d4d2a6545221aa5792bbc492b2098266d941984a353ae

    SHA512

    4902170a544f584f16a7bf88b5da33b51fc1ba7d56b40c873f3e6c75fa4e0232cfb2279e0570d4bac708141b7379ac5485617291a5af066aedf5d448466eb844

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    Filesize

    777KB

    MD5

    6252bb04a39f50284dd7e1c2d5bebc71

    SHA1

    778ec13248e7d8f87fc885105f5f9b69210f94d8

    SHA256

    f5e5343c14eaba8e4f73b3b6655fe4219ff971276f4df9b59b17aabf27c88d4d

    SHA512

    b153a09c22c97d65246fe50a40816276a2721310f75b14c45d934bedef8fa2002df940e5f05d8279245cf6fb42e66335d715390eaac4d7e6c678468330e7c3a8

  • C:\Program Files\7-Zip\ncjookla.tmp

    Filesize

    1.1MB

    MD5

    817307629f1f9bbbacb441166fe3a345

    SHA1

    70b97e1375c53c31654b0650f4fd0973358b360e

    SHA256

    481dc73e342aa7381cbfd2a58f058c47d7be6cb546bf500e00ca120d708477fa

    SHA512

    e7fcb15e9cda3a67721c5d7676b7e555c901d651f5a50094ded465086f7cdf5d521a4b0b61539676f957a291534a0f55f3a3b50d7f509d5a63608436a0d33f0e

  • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

    Filesize

    797KB

    MD5

    6609b284eefc1c910aad19e181aaec34

    SHA1

    4f93bc747cee6e35428fd5ae88e34e19d796caef

    SHA256

    41332cb4128389e17e0d4433118e36a04ab7f76dfda4c05e8e1eaac700c1ec92

    SHA512

    cf43119296dc692f3dfef16d08e544311b4c635093b1ad2006e535afc789543dc9e51baa2faaf5dbb78c62abd7d0f7880007b8480e52c506bd01b5aafdc2a510

  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

    Filesize

    2.1MB

    MD5

    082053faed2bb4488cd2b1819f04b591

    SHA1

    ef514348de89924fb338ae91176b2c9d563d17e8

    SHA256

    b3a942f49b7bcf920f16160782f0775b2de596d30aceaba7349f467d7d4ae156

    SHA512

    53fa7865e235e8166b45171b9ea264ed261d8fca1a0be9c10b279668bdadbe4457c3ebd0dd1d407bf2553651526f6952ab0abb77c2343db66c03a343c87113d0

  • C:\Windows\System32\AgentService.exe

    Filesize

    1.7MB

    MD5

    63dc9c26522e7a1d920885a03b9a55ed

    SHA1

    3594400e58ccafbf04c15e9d2725f176f026ab56

    SHA256

    8cc5d34b4352f3da785526e2698b184406ad25d0332180c84b3f3c95a76c876b

    SHA512

    0285a0fa690dbaff1d4b7b78393a75533061fd0ebb07d7c9c304136bee60472882a68e5ece19db99881bbea84d447bbee37253e8c2d86b6a7d9ae1f547450cb4

  • C:\Windows\System32\OpenSSH\ssh-agent.exe

    Filesize

    928KB

    MD5

    a839c15a41b3cc4215fdba51986faef2

    SHA1

    e7ffa88142b696c6c64b7a9e85a5d6e660c6f624

    SHA256

    058508b31eafb01fadebc84914386fe07a6a0565645952d2a5736ce3bd4dba77

    SHA512

    70bff52cf53b2013cc3131bd9ff4826470ce80a6211cf837e66bc71b4450cd6d13c3cceed9cbf30b0388b2533ee1438e2df23bb1e616d274e4d4ab7a3b96db8c

  • C:\Windows\System32\hkjijcol.tmp

    Filesize

    1.3MB

    MD5

    ef9446122ead4e623e3df799d533f21b

    SHA1

    10426e7e0534e8ef73cca36156db92c45f6cd729

    SHA256

    34edb7007d23256ccaaf2c8d095d64b230257eeb8460e61aacd2294f71cc1f6f

    SHA512

    ec2957c3e8abc432d0e402c98e8627554e8346f07903a9465c2de5dc94d2b9da9e008cf5133b905ef54241744e777876e3dfc5e86bea8596f114dacb41bf813b

  • C:\Windows\System32\wbengine.exe

    Filesize

    2.1MB

    MD5

    a2b319aa4d7952d3faecba0344e17c25

    SHA1

    04d7850dc97fa7db655b5e525f1f109572c1eaf1

    SHA256

    050cffb8b7236cfab561929c029c0751537bc8ac4428650803267c65de03c095

    SHA512

    ce7c2d7773bbb4cefe59bc88c1da497092ee41505ceb4bc72b0cd5469543c58c7f1a99af8883892064599230294c3835906048cffb2be77ce2802849af50b2a0

  • \??\c:\program files\windows media player\wmpnetwk.exe

    Filesize

    1.5MB

    MD5

    e67efd4573a66c2645d43749e7895e1a

    SHA1

    594356b9d7ed741ba395b787716c2f014a473f87

    SHA256

    94e430bd4597201517465980bc3ef73df0a49cc9f94e2cb576fd2cc5ac278483

    SHA512

    2c19a307738a121ee781bd9d23ebb02a36c09e26bad46bd4fa65c61c7ea1bacff40133bb8cdb7b7712a9306eda0cd76890faa644e4dfe48865efeb2d16a5600d

  • \??\c:\windows\system32\fxssvc.exe

    Filesize

    1.2MB

    MD5

    db0182254467c11e3663fb34e2e2fc43

    SHA1

    a2c1669fe9561b209b971e6dd833d06b4d55ec31

    SHA256

    d6545fad504351691aaa83e4ef94b9c9c9e8686bf894e5ab57611062a99f236f

    SHA512

    73120e80037f18c16fdd7f4b106aaf957136703e5badafe93bed9f27e9e1b2786e5cfceb139ebc608c20173a7a88b2d4f9389a489b3a301884e53a45ed67106b

  • \??\c:\windows\system32\msdtc.exe

    Filesize

    700KB

    MD5

    348773c3727e2b94e336ec2a8cc1a02c

    SHA1

    9cf9a5ed764065b630717c809016ab82dc11bedb

    SHA256

    2a678a1ef39a95a984493de5d0f938ab05872acfd436a22f7c8570ea4d87e505

    SHA512

    2a77ef3e72df4db4fb10c4f9027d8deddbdc76c576404bdcf2846f826e39caa6ba2ea89be4a71a6534241ad9748735759f4b52ba82d0a683d390b4590a2adbee

  • \??\c:\windows\system32\msiexec.exe

    Filesize

    623KB

    MD5

    7926e8f1822713ee9019e07cc35198ef

    SHA1

    ad07527bafa2f44523aeb69bebec5bafe82a55da

    SHA256

    124e681e2f4b282cfc985425bf6b53dc1c65fa8d921e81caf2edd9786f0a01ac

    SHA512

    cc546efbabfb4aaec9da2b8d43b686b9aebc8f3859626862d7d28d215ca8ae443e021366b9a0206068631c751386119703a1b63c0597a369dc8baa5f03bc9713

  • \??\c:\windows\system32\snmptrap.exe

    Filesize

    572KB

    MD5

    8aa16914b0686525eb857bce18267557

    SHA1

    8717d134a1cbfd51807363e09ab2ef4dfaa304af

    SHA256

    c1b66ce02bd858c3ef2aeaeb831e0b552b0258d6920bfdc0df8e6a45de8d2436

    SHA512

    a8d701547c59b8972632de8cb0ca93c80538a95c4a8e95a95b2b04c0fd97f02d9d7562128af2742505fdf48a8401f2cfd20aba2e1e0bfd0f4da948f288160886

  • memory/216-43-0x0000000140000000-0x000000014038E000-memory.dmp

    Filesize

    3.6MB

  • memory/216-44-0x0000000140000000-0x000000014038E000-memory.dmp

    Filesize

    3.6MB

  • memory/768-78-0x0000000140000000-0x0000000140229000-memory.dmp

    Filesize

    2.2MB

  • memory/768-142-0x0000000140000000-0x0000000140229000-memory.dmp

    Filesize

    2.2MB

  • memory/2072-51-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-3-0x0000000002270000-0x00000000022B8000-memory.dmp

    Filesize

    288KB

  • memory/2072-5-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-21-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-42-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-4-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-1-0x0000000140031000-0x0000000140032000-memory.dmp

    Filesize

    4KB

  • memory/2072-2-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-6-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-22-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-23-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-24-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-0-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2072-141-0x0000000140000000-0x000000014032E000-memory.dmp

    Filesize

    3.2MB

  • memory/2220-61-0x0000000140000000-0x0000000140228000-memory.dmp

    Filesize

    2.2MB

  • memory/2220-60-0x0000000140000000-0x0000000140228000-memory.dmp

    Filesize

    2.2MB

  • memory/2900-143-0x0000000140000000-0x000000014025B000-memory.dmp

    Filesize

    2.4MB

  • memory/2900-91-0x0000000140000000-0x000000014025B000-memory.dmp

    Filesize

    2.4MB

  • memory/3704-106-0x0000000140000000-0x000000014036F000-memory.dmp

    Filesize

    3.4MB

  • memory/3704-154-0x0000000140000000-0x000000014036F000-memory.dmp

    Filesize

    3.4MB

  • memory/4192-52-0x0000000140000000-0x0000000140385000-memory.dmp

    Filesize

    3.5MB

  • memory/4192-53-0x0000000140000000-0x0000000140385000-memory.dmp

    Filesize

    3.5MB

  • memory/4668-104-0x0000000140000000-0x0000000140319000-memory.dmp

    Filesize

    3.1MB

  • memory/4668-98-0x0000000140000000-0x0000000140319000-memory.dmp

    Filesize

    3.1MB