Analysis
- max time kernel
144s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20241007-en - resource tags
- submitted
16/10/2024, 15:13
General
- Target Open AI Sora 4.0_Setup_Version 5.96.exe
- Size 349KB
- Sample241016-sl557sweja
- SHA256 92a304e64a65bbab9a45b6cb0d3f701fe0803616d23f5f9b860d3b00488f2482
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Open AI Sora 4.0_Setup_Version 5.96.exe"C:\Users\Admin\AppData\Local\Temp\Open AI Sora 4.0_Setup_Version 5.96.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\app-5.96.0\Open AI Sora 4.0_Setup_Version 5.96.exe"C:\Users\Admin\AppData\Local\Temp\app-5.96.0\Open AI Sora 4.0_Setup_Version 5.96.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Stop-Process -Name "msedge"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Stop-Process -Name "firefox"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Stop-Process -Name "firefox"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe"C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_aj4kpkwk.uhh.ps1
memory/1512-195-0x0000000006260000-0x00000000065B7000-memory.dmp
memory/3984-32-0x000000002FC10000-0x000000002FCB5000-memory.dmp
memory/3984-52-0x00000000302C0000-0x0000000030356000-memory.dmp
memory/3984-3-0x00000000070B0000-0x0000000007A39000-memory.dmp
memory/3984-12-0x0000000006A10000-0x0000000006A2D000-memory.dmp
memory/3984-16-0x0000000006A60000-0x0000000006A88000-memory.dmp
memory/3984-13-0x0000000006A60000-0x0000000006A88000-memory.dmp
memory/3984-9-0x0000000006A10000-0x0000000006A2D000-memory.dmp
memory/3984-17-0x000000002F9D0000-0x000000002FB5E000-memory.dmp
memory/3984-21-0x0000000006F70000-0x0000000006FA0000-memory.dmp
memory/3984-24-0x0000000006F70000-0x0000000006FA0000-memory.dmp
memory/3984-60-0x000000002FD10000-0x000000002FD4C000-memory.dmp
memory/3984-57-0x000000002FD10000-0x000000002FD4C000-memory.dmp
memory/3984-56-0x000000002FE30000-0x000000002FEAA000-memory.dmp
memory/3984-53-0x000000002FE30000-0x000000002FEAA000-memory.dmp
memory/3984-49-0x00000000302C0000-0x0000000030356000-memory.dmp
memory/3984-48-0x000000002FDD0000-0x000000002FE24000-memory.dmp
memory/3984-45-0x000000002FDD0000-0x000000002FE24000-memory.dmp
memory/3984-44-0x000000002FD50000-0x000000002FDC5000-memory.dmp
memory/3984-41-0x000000002FD50000-0x000000002FDC5000-memory.dmp
memory/3984-40-0x000000002FBE0000-0x000000002FBF1000-memory.dmp
memory/3984-37-0x000000002FBE0000-0x000000002FBF1000-memory.dmp
memory/3984-36-0x0000000007080000-0x0000000007095000-memory.dmp
memory/3984-33-0x0000000007080000-0x0000000007095000-memory.dmp
memory/3984-0-0x00000000070B0000-0x0000000007A39000-memory.dmp
memory/3984-29-0x000000002FC10000-0x000000002FCB5000-memory.dmp
memory/3984-28-0x000000002FEC0000-0x0000000030216000-memory.dmp
memory/3984-4-0x0000000000974000-0x0000000000975000-memory.dmp
memory/3984-20-0x000000002F9D0000-0x000000002FB5E000-memory.dmp
memory/3984-25-0x000000002FEC0000-0x0000000030216000-memory.dmp
memory/3984-8-0x0000000006AC0000-0x0000000006B67000-memory.dmp
memory/3984-5-0x0000000006AC0000-0x0000000006B67000-memory.dmp
memory/3984-64-0x0000000030280000-0x0000000030292000-memory.dmp
memory/3984-61-0x0000000030280000-0x0000000030292000-memory.dmp
memory/4632-161-0x0000000006080000-0x00000000060CC000-memory.dmp
memory/4632-159-0x0000000005C20000-0x0000000005F77000-memory.dmp
memory/4632-145-0x00000000735C0000-0x0000000073D71000-memory.dmp
memory/4632-146-0x00000000054A0000-0x0000000005ACA000-memory.dmp
memory/4632-147-0x00000000051B0000-0x00000000051D2000-memory.dmp
memory/4632-150-0x00000000735C0000-0x0000000073D71000-memory.dmp
memory/4632-148-0x0000000005AD0000-0x0000000005B36000-memory.dmp
memory/4632-149-0x0000000005BB0000-0x0000000005C16000-memory.dmp
memory/4632-164-0x00000000065C0000-0x00000000065E2000-memory.dmp
memory/4632-143-0x00000000735CE000-0x00000000735CF000-memory.dmp
memory/4632-144-0x0000000002870000-0x00000000028A6000-memory.dmp
memory/4632-163-0x0000000006570000-0x000000000658A000-memory.dmp
memory/4632-160-0x0000000006040000-0x000000000605E000-memory.dmp
memory/4632-165-0x0000000007660000-0x0000000007C06000-memory.dmp
memory/4632-162-0x0000000007010000-0x00000000070A6000-memory.dmp
memory/4632-168-0x00000000735C0000-0x0000000073D71000-memory.dmp
memory/4788-179-0x00000000735C0000-0x0000000073D71000-memory.dmp
memory/4788-181-0x00000000735C0000-0x0000000073D71000-memory.dmp
memory/4788-180-0x00000000735C0000-0x0000000073D71000-memory.dmp
memory/4788-190-0x00000000054F0000-0x0000000005847000-memory.dmp
memory/4788-193-0x00000000735C0000-0x0000000073D71000-memory.dmp