Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-10-2024 15:13
General
-
Target
app-5.96.0/Open AI Sora 4.0_Setup_Version 5.96.exe
-
Size
744.1MB
-
MD5
33e4c114789665f10c3f11ffea9d2ba3
-
SHA1
5fefd509d0e38b6bed0867fb9780ff1208d5cc6a
-
SHA256
99a4657b318daeec77a6ea8eb8082a16d58dd18c179e5df6f01e687bf99be58b
-
SHA512
c16b9cb968a03f852046919f34b975363eaf8082510c6cc3da119ddaac107d3a65da0d02b5c1906396f8a1abe59cf3dbbdca568eaff106828cf0975c00410781
-
SSDEEP
3145728:/hSx3pv753l36cJoYuuuuuuuvZzwJgFoR:pSnT53hVm6R
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\app-5.96.0\Open AI Sora 4.0_Setup_Version 5.96.exe"C:\Users\Admin\AppData\Local\Temp\app-5.96.0\Open AI Sora 4.0_Setup_Version 5.96.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Stop-Process -Name "msedge"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Stop-Process -Name "firefox"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Stop-Process -Name "firefox"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe"C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5def65711d78669d7f8e69313be4acf2e
SHA16522ebf1de09eeb981e270bd95114bc69a49cda6
SHA256aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
SHA51205b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
-
Filesize
17KB
MD53771e11a8dd2b4ec3332a1b7b7bb91b8
SHA10f2be33598790bb54ea0b9f7786f893f4a1a6746
SHA25646061c699c92f28c08f2053c216d0be107e4805fed122f426359d50d62684cff
SHA512b563bc66e290f6a9a71235bfb3a254b138fc4f5fed71f5e9f8dc8e7a4c529dc3ea354903c23c52c53c773a004ffa268907515272913ceca8784f9cc21e6eb5b5
-
Filesize
17KB
MD5c1d7580d4dfac2573e4c72456a677a11
SHA171a9443d7192acf1bb5144aa40aff7de067f6533
SHA256592aabf20359769b067604495e1e8e1d3764d9452060312fe6ccd7f1e8f776b5
SHA5121343b44c5e2150ec6b2bf65078fde0eaea76f0b96e6f2662d214f23d3aa8d2392a641f81535333c1fe381b23e170f27b227f2cdcaa1ebad3e4f2c6f5b5fc370a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
468KB
-
Filesize
336KB
-
Filesize
3.3MB
-
Filesize
668KB
-
Filesize
116KB
-
Filesize
1.6MB
-
Filesize
192KB
-
Filesize
3.3MB
-
Filesize
468KB
-
Filesize
600KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
600KB
-
Filesize
160KB
-
Filesize
336KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
660KB
-
Filesize
9.5MB
-
Filesize
660KB
-
Filesize
668KB
-
Filesize
9.5MB
-
Filesize
116KB
-
Filesize
192KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
160KB
-
Filesize
3.3MB
-
Filesize
5.6MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
600KB
-
Filesize
104KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB