Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-10-2024 20:25

General

  • Target

    app-11.4.0/Open AI Sora 4.0 Verison 4.89.exe

  • Size

    717.9MB

  • MD5

    4ca74930fb928138ef72335d06cc39db

  • SHA1

    14ea9754494af1beb429224911b2ec2f43d3a802

  • SHA256

    86f1e1adb0542298fede2316612d6a90ab655a2774d5bc766c4eb77e0bd25e70

  • SHA512

    7aaa890c51d012eced7d1f565b61a9d3dc2480945e4ef1509806763cd48fa016ee4c9c44bde44bc10da34b00aee3e897038f200b19b9e136cb98788a6977bee2

  • SSDEEP

    3145728:lnOvz6yqIkFIkFIkFIkFIkFIkFIkFIkYZzwJgFos:eGIkFIkFIkFIkFIkFIkFIkFIk5m6s

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\app-11.4.0\Open AI Sora 4.0 Verison 4.89.exe
    "C:\Users\Admin\AppData\Local\Temp\app-11.4.0\Open AI Sora 4.0 Verison 4.89.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Stop-Process -Name "msedge"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3332
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Stop-Process -Name "firefox"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:760
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Stop-Process -Name "firefox"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1044
    • C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe
      "C:\Users\Admin\AppData\Local\Public Program\Chrome Service.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    1KB

    MD5

    def65711d78669d7f8e69313be4acf2e

    SHA1

    6522ebf1de09eeb981e270bd95114bc69a49cda6

    SHA256

    aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

    SHA512

    05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    17KB

    MD5

    a2d8e4d213bfd199c7abf5b5b3d91e0a

    SHA1

    6618a25104b173190de8b613ca8f6f900a8af368

    SHA256

    883fd39c2e7a652f131429bc71a268a32ff592cf3c5d0c729f8596a7d18f2a76

    SHA512

    9b8be87ed0e12c5d5a7aeb66e5225528f388a06a834e9db511bc87e10b77d78651d8cdad2fdf5bf9b275d3e96448196f96937ee5d3dcd2fb40ee9850306733d6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    17KB

    MD5

    d33cce10257de9d42ffbca845d21a0f2

    SHA1

    9c4b3747dbbe8457a5a67d0a05667dfa8aece0e3

    SHA256

    010cfb7fc9b3a3bf2339c0c99700871be793fc49cbe085ab9e991e545e843e97

    SHA512

    047915e97b0fd6195ea45d7a7a3045d6722decf354d19c76a68ba49647cdc7cb27d0296bdf5ee463b0ea7e51c4a01a061705e4d0eee9b95395eb3fd76c009ece

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_atfa2zgf.auz.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/760-179-0x0000000073E50000-0x0000000074600000-memory.dmp

    Filesize

    7.7MB

  • memory/760-180-0x0000000073E50000-0x0000000074600000-memory.dmp

    Filesize

    7.7MB

  • memory/760-181-0x0000000073E50000-0x0000000074600000-memory.dmp

    Filesize

    7.7MB

  • memory/760-194-0x0000000073E50000-0x0000000074600000-memory.dmp

    Filesize

    7.7MB

  • memory/760-191-0x00000000058D0000-0x0000000005C24000-memory.dmp

    Filesize

    3.3MB

  • memory/1044-201-0x0000000005460000-0x00000000057B4000-memory.dmp

    Filesize

    3.3MB

  • memory/2912-39-0x000000002DED0000-0x000000002DEE1000-memory.dmp

    Filesize

    68KB

  • memory/2912-23-0x0000000006AB0000-0x0000000006AE0000-memory.dmp

    Filesize

    192KB

  • memory/2912-15-0x00000000069C0000-0x00000000069E8000-memory.dmp

    Filesize

    160KB

  • memory/2912-16-0x000000002E050000-0x000000002E1DE000-memory.dmp

    Filesize

    1.6MB

  • memory/2912-31-0x000000002DF70000-0x000000002E015000-memory.dmp

    Filesize

    660KB

  • memory/2912-51-0x000000002E370000-0x000000002E406000-memory.dmp

    Filesize

    600KB

  • memory/2912-59-0x000000002E2C0000-0x000000002E2FC000-memory.dmp

    Filesize

    240KB

  • memory/2912-56-0x000000002E2C0000-0x000000002E2FC000-memory.dmp

    Filesize

    240KB

  • memory/2912-64-0x000000002DF60000-0x000000002DF66000-memory.dmp

    Filesize

    24KB

  • memory/2912-63-0x000000002E020000-0x000000002E032000-memory.dmp

    Filesize

    72KB

  • memory/2912-60-0x000000002E020000-0x000000002E032000-memory.dmp

    Filesize

    72KB

  • memory/2912-55-0x000000002E410000-0x000000002E48A000-memory.dmp

    Filesize

    488KB

  • memory/2912-52-0x000000002E410000-0x000000002E48A000-memory.dmp

    Filesize

    488KB

  • memory/2912-48-0x000000002E370000-0x000000002E406000-memory.dmp

    Filesize

    600KB

  • memory/2912-47-0x000000002E260000-0x000000002E2B4000-memory.dmp

    Filesize

    336KB

  • memory/2912-44-0x000000002E260000-0x000000002E2B4000-memory.dmp

    Filesize

    336KB

  • memory/2912-43-0x000000002E1E0000-0x000000002E255000-memory.dmp

    Filesize

    468KB

  • memory/2912-40-0x000000002E1E0000-0x000000002E255000-memory.dmp

    Filesize

    468KB

  • memory/2912-11-0x0000000006970000-0x000000000698D000-memory.dmp

    Filesize

    116KB

  • memory/2912-36-0x000000002DED0000-0x000000002DEE1000-memory.dmp

    Filesize

    68KB

  • memory/2912-35-0x0000000006AE0000-0x0000000006AF5000-memory.dmp

    Filesize

    84KB

  • memory/2912-32-0x0000000006AE0000-0x0000000006AF5000-memory.dmp

    Filesize

    84KB

  • memory/2912-27-0x000000002E540000-0x000000002E896000-memory.dmp

    Filesize

    3.3MB

  • memory/2912-28-0x000000002DF70000-0x000000002E015000-memory.dmp

    Filesize

    660KB

  • memory/2912-24-0x000000002E540000-0x000000002E896000-memory.dmp

    Filesize

    3.3MB

  • memory/2912-8-0x0000000006970000-0x000000000698D000-memory.dmp

    Filesize

    116KB

  • memory/2912-19-0x000000002E050000-0x000000002E1DE000-memory.dmp

    Filesize

    1.6MB

  • memory/2912-20-0x0000000006AB0000-0x0000000006AE0000-memory.dmp

    Filesize

    192KB

  • memory/2912-3-0x00000000070D0000-0x0000000007A59000-memory.dmp

    Filesize

    9.5MB

  • memory/2912-0-0x00000000070D0000-0x0000000007A59000-memory.dmp

    Filesize

    9.5MB

  • memory/2912-4-0x00000000010A4000-0x00000000010A5000-memory.dmp

    Filesize

    4KB

  • memory/2912-5-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2912-12-0x00000000069C0000-0x00000000069E8000-memory.dmp

    Filesize

    160KB

  • memory/3332-145-0x0000000073E50000-0x0000000074600000-memory.dmp

    Filesize

    7.7MB

  • memory/3332-162-0x0000000007530000-0x00000000075C6000-memory.dmp

    Filesize

    600KB

  • memory/3332-149-0x0000000005D30000-0x0000000005D96000-memory.dmp

    Filesize

    408KB

  • memory/3332-159-0x0000000005DA0000-0x00000000060F4000-memory.dmp

    Filesize

    3.3MB

  • memory/3332-147-0x0000000005B20000-0x0000000005B42000-memory.dmp

    Filesize

    136KB

  • memory/3332-161-0x00000000063B0000-0x00000000063FC000-memory.dmp

    Filesize

    304KB

  • memory/3332-148-0x0000000005CC0000-0x0000000005D26000-memory.dmp

    Filesize

    408KB

  • memory/3332-146-0x0000000073E50000-0x0000000074600000-memory.dmp

    Filesize

    7.7MB

  • memory/3332-160-0x0000000006370000-0x000000000638E000-memory.dmp

    Filesize

    120KB

  • memory/3332-144-0x0000000005470000-0x0000000005A98000-memory.dmp

    Filesize

    6.2MB

  • memory/3332-143-0x0000000004DA0000-0x0000000004DD6000-memory.dmp

    Filesize

    216KB

  • memory/3332-142-0x0000000073E5E000-0x0000000073E5F000-memory.dmp

    Filesize

    4KB

  • memory/3332-163-0x0000000007410000-0x000000000742A000-memory.dmp

    Filesize

    104KB

  • memory/3332-164-0x0000000007490000-0x00000000074B2000-memory.dmp

    Filesize

    136KB

  • memory/3332-165-0x0000000007B80000-0x0000000008124000-memory.dmp

    Filesize

    5.6MB

  • memory/3332-168-0x0000000073E50000-0x0000000074600000-memory.dmp

    Filesize

    7.7MB