Analysis

  • max time kernel
    143s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-10-2024 15:13

General

  • Target

    Open AI Sora 4.0_Setup_Version 5.96.exe

  • Size

    349KB

  • MD5

    ceb804d5dcb9e543549fdf842611dcc3

  • SHA1

    630b4a55ec6ea4acb163422c1938ddb389340af7

  • SHA256

    92a304e64a65bbab9a45b6cb0d3f701fe0803616d23f5f9b860d3b00488f2482

  • SHA512

    9c380596001d7ed1ba18b826b13ac28fd9b3fed16a87fa1ed648f4534431e3dc756e3179ad5e5c12f1778ebe028446fb05597d3fc347221a6611f7af88998d82

  • SSDEEP

    3072:sV/GaFJJZ+Qima9IjVe9+L+xZ2N4OCSPQwZkXkAy5vHOQXQWXUjzBW2HwbvWUhIj:6Bmm+aVecLuK0uPZQk4QU9Wew7G

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Open AI Sora 4.0_Setup_Version 5.96.exe
    "C:\Users\Admin\AppData\Local\Temp\Open AI Sora 4.0_Setup_Version 5.96.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\AppData\Local\Temp\app-5.96.0\Open AI Sora 4.0_Setup_Version 5.96.exe
      "C:\Users\Admin\AppData\Local\Temp\app-5.96.0\Open AI Sora 4.0_Setup_Version 5.96.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:404
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Stop-Process -Name "msedge"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2692
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Stop-Process -Name "firefox"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3212
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Stop-Process -Name "firefox"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4848
      • C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe
        "C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    1KB

    MD5

    def65711d78669d7f8e69313be4acf2e

    SHA1

    6522ebf1de09eeb981e270bd95114bc69a49cda6

    SHA256

    aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

    SHA512

    05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    17KB

    MD5

    92c06fdc8cd72a0b4d1b71a5f051df73

    SHA1

    c322765dd9cc1d277f3538adf7242fc5f10e002c

    SHA256

    47c9490331c4e4a346c45bf60d3426aaaf1eb7271f2c5bc35ccd00ea1676380d

    SHA512

    ee4e4e5e6d3cc3b4b08fd4d62948c6c6f496de1cf02553e625142b6e6f139b941741260722bb6d383ad508f9d97b5388eea35e3510da611f5a4d9f49ff126756

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    17KB

    MD5

    2aeb6b94e066740e19976cbc02799928

    SHA1

    54290ae8e057b86135d1b41212e75cdc46d07b34

    SHA256

    067b9212850f13b0b7747e3c1b77a6098ac9e72f8f3f4323d8c266347ceba8aa

    SHA512

    9476f8db57fd4b93cb74d6d040456d996cafb25421b13f3a2e0b26ea34875d4f9366fa158fa7e2c3656aafdc8fee4fb0291a3a7fdf97f925f04a9e7736536ab8

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_psys1n40.teg.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/404-0-0x0000000006E80000-0x0000000007809000-memory.dmp

    Filesize

    9.5MB

  • memory/404-4-0x00000000005A4000-0x00000000005A5000-memory.dmp

    Filesize

    4KB

  • memory/404-3-0x0000000006E80000-0x0000000007809000-memory.dmp

    Filesize

    9.5MB

  • memory/404-8-0x0000000006750000-0x00000000067F7000-memory.dmp

    Filesize

    668KB

  • memory/404-12-0x00000000066D0000-0x00000000066ED000-memory.dmp

    Filesize

    116KB

  • memory/404-16-0x0000000006720000-0x0000000006748000-memory.dmp

    Filesize

    160KB

  • memory/404-13-0x0000000006720000-0x0000000006748000-memory.dmp

    Filesize

    160KB

  • memory/404-9-0x00000000066D0000-0x00000000066ED000-memory.dmp

    Filesize

    116KB

  • memory/404-5-0x0000000006750000-0x00000000067F7000-memory.dmp

    Filesize

    668KB

  • memory/404-20-0x000000002F6A0000-0x000000002F82E000-memory.dmp

    Filesize

    1.6MB

  • memory/404-24-0x0000000006D30000-0x0000000006D60000-memory.dmp

    Filesize

    192KB

  • memory/404-25-0x000000002FB90000-0x000000002FEE6000-memory.dmp

    Filesize

    3.3MB

  • memory/404-41-0x000000002FA20000-0x000000002FA95000-memory.dmp

    Filesize

    468KB

  • memory/404-57-0x000000002F9E0000-0x000000002FA1C000-memory.dmp

    Filesize

    240KB

  • memory/404-65-0x000000002F8D0000-0x000000002F8D6000-memory.dmp

    Filesize

    24KB

  • memory/404-64-0x000000002FF30000-0x000000002FF42000-memory.dmp

    Filesize

    72KB

  • memory/404-61-0x000000002FF30000-0x000000002FF42000-memory.dmp

    Filesize

    72KB

  • memory/404-56-0x000000002FB00000-0x000000002FB7A000-memory.dmp

    Filesize

    488KB

  • memory/404-52-0x000000002FF90000-0x0000000030026000-memory.dmp

    Filesize

    600KB

  • memory/404-49-0x000000002FF90000-0x0000000030026000-memory.dmp

    Filesize

    600KB

  • memory/404-48-0x000000002FAA0000-0x000000002FAF4000-memory.dmp

    Filesize

    336KB

  • memory/404-45-0x000000002FAA0000-0x000000002FAF4000-memory.dmp

    Filesize

    336KB

  • memory/404-44-0x000000002FA20000-0x000000002FA95000-memory.dmp

    Filesize

    468KB

  • memory/404-40-0x000000002F890000-0x000000002F8A1000-memory.dmp

    Filesize

    68KB

  • memory/404-37-0x000000002F890000-0x000000002F8A1000-memory.dmp

    Filesize

    68KB

  • memory/404-36-0x0000000006E40000-0x0000000006E55000-memory.dmp

    Filesize

    84KB

  • memory/404-33-0x0000000006E40000-0x0000000006E55000-memory.dmp

    Filesize

    84KB

  • memory/404-53-0x000000002FB00000-0x000000002FB7A000-memory.dmp

    Filesize

    488KB

  • memory/404-32-0x000000002F8E0000-0x000000002F985000-memory.dmp

    Filesize

    660KB

  • memory/404-29-0x000000002F8E0000-0x000000002F985000-memory.dmp

    Filesize

    660KB

  • memory/404-28-0x000000002FB90000-0x000000002FEE6000-memory.dmp

    Filesize

    3.3MB

  • memory/404-21-0x0000000006D30000-0x0000000006D60000-memory.dmp

    Filesize

    192KB

  • memory/404-17-0x000000002F6A0000-0x000000002F82E000-memory.dmp

    Filesize

    1.6MB

  • memory/2692-143-0x00000000738EE000-0x00000000738EF000-memory.dmp

    Filesize

    4KB

  • memory/2692-144-0x0000000004690000-0x00000000046C6000-memory.dmp

    Filesize

    216KB

  • memory/2692-146-0x0000000004DF0000-0x0000000005418000-memory.dmp

    Filesize

    6.2MB

  • memory/2692-145-0x00000000738E0000-0x0000000074090000-memory.dmp

    Filesize

    7.7MB

  • memory/2692-147-0x00000000738E0000-0x0000000074090000-memory.dmp

    Filesize

    7.7MB

  • memory/2692-148-0x0000000005420000-0x0000000005442000-memory.dmp

    Filesize

    136KB

  • memory/2692-150-0x00000000055F0000-0x0000000005656000-memory.dmp

    Filesize

    408KB

  • memory/2692-149-0x0000000005580000-0x00000000055E6000-memory.dmp

    Filesize

    408KB

  • memory/2692-160-0x0000000005760000-0x0000000005AB4000-memory.dmp

    Filesize

    3.3MB

  • memory/2692-161-0x0000000005C60000-0x0000000005C7E000-memory.dmp

    Filesize

    120KB

  • memory/2692-162-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

    Filesize

    304KB

  • memory/2692-165-0x0000000006190000-0x00000000061B2000-memory.dmp

    Filesize

    136KB

  • memory/2692-164-0x0000000006140000-0x000000000615A000-memory.dmp

    Filesize

    104KB

  • memory/2692-166-0x0000000007470000-0x0000000007A14000-memory.dmp

    Filesize

    5.6MB

  • memory/2692-163-0x0000000006E20000-0x0000000006EB6000-memory.dmp

    Filesize

    600KB

  • memory/2692-169-0x00000000738E0000-0x0000000074090000-memory.dmp

    Filesize

    7.7MB

  • memory/3212-180-0x00000000738E0000-0x0000000074090000-memory.dmp

    Filesize

    7.7MB

  • memory/3212-191-0x00000000738E0000-0x0000000074090000-memory.dmp

    Filesize

    7.7MB

  • memory/3212-190-0x00000000062C0000-0x0000000006614000-memory.dmp

    Filesize

    3.3MB

  • memory/3212-192-0x00000000738E0000-0x0000000074090000-memory.dmp

    Filesize

    7.7MB

  • memory/3212-195-0x00000000738E0000-0x0000000074090000-memory.dmp

    Filesize

    7.7MB

  • memory/4848-206-0x0000000005810000-0x0000000005B64000-memory.dmp

    Filesize

    3.3MB