expiro | 8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
Size

555KB
MD5

0a7488a74643a888ff7ed8af241f79f0
SHA1

3d92ac3c469821bdd0801ff641e1c69f63f22991
SHA256

8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268
SHA512

bc9b2a12b70752fc843644697c3eb82b94f247411599b28437ee43ebff8ec467d0be369a7438e824835378571de22300a9e802a3b35160336ad89de3986bf666
SSDEEP

12288:T7RRaMMMMM2MMMMM/H0jZrctbNgED36KATHFNpsOFgaPJn29BPP0Ih/2YDi:T7RRaMMMMM2MMMMM/HK5sbNgED36KArf

Score

10^/10

expiro backdoor credential_access discovery spyware stealer

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/memory/4540-2-0x0000000001000000-0x00000000011B0000-memory.dmp	family_expiro1

Executes dropped EXE 6 IoCs

pid	Process
2004	elevation_service.exe
976	elevation_service.exe
4864	maintenanceservice.exe
4588	OSE.EXE
3812	ssh-agent.exe
4440	TrustedInstaller.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\E:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\G:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\I:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\P:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\V:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\Z:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\H:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\N:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\O:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\T:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\W:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\Y:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\J:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\M:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\R:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\S:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\K:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\L:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\Q:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened (read-only)	\??\U:	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe

Drops file in System32 directory 61 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\spectrum.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\Agentservice.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\locator.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\sensordataservice.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\windows\system32\openssh\ssh-agent.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\vds.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\windows\system32\Appvclient.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\windows\system32\msdtc.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\windows\system32\wbengine.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\alg.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\windows\system32\Agentservice.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\sgrmbroker.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\windows\system32\snmptrap.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\perfhost.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\windows\system32\fxssvc.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\windows\system32\msiexec.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	\??\c:\program files\google\chrome\Application\123.0.6312.123\elevation_service.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Internet Explorer\ExtExport.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\7-Zip\7zG.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\7-Zip\7zFM.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.vir	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4540	8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe

C:\Users\Admin\AppData\Local\Temp\8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe
"C:\Users\Admin\AppData\Local\Temp\8a137c78930750ea81be840136ad60de250a408f040acf204f95ddad1bd1c268N.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:976

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3812

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.0MB

MD5
3087f487be1d4065cd51fcb350367b6a

SHA1
5eaca9e4753c340c2a735e3feee4ced3e1707ab6

SHA256
7ab9aec8cd8b73e7de746304c5536a25e3e55649d71971b5f3ddebbc19d3600f

SHA512
b639a415e615b22ba6f67cf867bd6513222ee3a8ca4a159e529f32187e5d8e80a29431402db48fb34d812ed35e537dbf1cf0e468116ecb0ef1814ca6a0f732bd

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
719KB

MD5
95ca3dfb8626ee706a239c7045eb5979

SHA1
cdf6de0220abeae51255553bf982a28b596c3d59

SHA256
0dc55401a3913e85b0804abac7894fa1357f13c8fc1a2f8f9d4da29f9760d66f

SHA512
968c071c1a09426d2f9bd48da95249225d9fbb6a2754658093d33664d7606f2480e7af78e1282eda7443a252f14cbe1a311cb870465238c82f5c732a99e00d91

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
736KB

MD5
24889658a96c3063ccd505be3e80757f

SHA1
7140e06c1e36a7a44119b1c17e0687d36873c586

SHA256
c53d4c4ea4cda20aadb7436c7a6de26c9783ed92b5c6a6c2453e4d9130ab05f5

SHA512
24ea448ddf48809d7a5b7f459fc32ccf58634f1384ee3553bf6c692ef945e8a33ccf24d247008953ec27731ae8e79a0687ef132da60649683aaadc30dd098f48

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.vir

Filesize
4.5MB

MD5
32350471480dbf8fcbf958dbb895b9e9

SHA1
ce625aa9bae20e6d12b7e7255b444feee9676f63

SHA256
9925b8676bc655cc9dcbabeedaa19e0dc3d0310e0f45b2c1962cd13da19b3d81

SHA512
dffe3661e517f8a9e30437467ac1b536cd79f9c3109de62deb56716ff581499c4c0d6a56bddf55bf1bb4fe2e2285649bf6e5d05807b2eac90ed9dba8315f24ab

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

Filesize
2.1MB

MD5
bdc75e14105c6c02ed4a0a14978c996f

SHA1
51da46033ae4263d735aae182a7d11404678a4c4

SHA256
1f06f914bf3d2adcd846a60b8b17724d67dbbee4fa60dc95aed05135df6d7f79

SHA512
0c25591cef14b3b499104f35e1826d35bde78962347dd0f8c06d578f972dd5e9709a6d60259d06727f6cae01fb8d63f878a79f9076c43e9683e3444876c99781

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.3MB

MD5
f7d2f21f71cfd87ceca9b3d6a6aa5334

SHA1
83f1099c7d67abc4ef0ecc952d510f547f669fc6

SHA256
611dcf1a77552c1436faccecc3e6436f708d89ca191c049ef32b847c3a473be1

SHA512
94bb2001089f3cce57fc7ca4fccb95a54597fa83ea0a49508c494dd1aff032b5a5cbe453baca2987177edfc061729c8e525f5a9747632c16165514db95c98e8a

Download Submit
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Filesize
919KB

MD5
cd40e8fad0bc59601152520ae4099a60

SHA1
4a98d473f289c8fbaa5e662fd8fe234b81b59df9

SHA256
202d745fb01bebb2d41fa60c54cec4d51d2475211366e1afcc1e4bcea90c8efa

SHA512
333ecafc7025719de85a7723c096dba8a6b06b77baca26389c98a98a45c65cba48763fc50e43ca3c59acb1ac3ba10085c1e0c6b59949ed10918c6dba670f3d94

Download Submit
C:\Windows\System32\Appvclient.vir

Filesize
1.2MB

MD5
03d51e339c0ea439e9a3ab7c9e8b89bd

SHA1
d7d01df597f3955078bc226aa9d3613476737d75

SHA256
1a8d3a8b6f073a0d5758ea2a6555e88577e46f5cb805a2c911cbd86d26870653

SHA512
57a9670fc6597490f9aa0447e2fba70b3e53ec813b32626e97f37b8c3dfab0542eec32b06aed91d0bfb83a2b08b4b253fa5bfd7f655736d1740b78b24e927eb5

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
870KB

MD5
65d84ef21176e766786379b928d8e3f9

SHA1
3cd369f353ce9462f694dce9fc0781b67c5b6986

SHA256
88d5451026a2e343507f74b59c97cf521963dbb0159087ec91524bf7782bac5f

SHA512
2f83ddeb24bf3508ea9d6eecf8c2f4c46bf744d1ae96840225e0abbf42f23e466e933659a353bde60f0b56d1bbe2983b7ebe06b6b1e2a5f0f458852c8b0d5588

Download Submit
C:\Windows\servicing\TrustedInstaller.exe

Filesize
193KB

MD5
805418acd5280e97074bdadca4d95195

SHA1
a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6

SHA256
73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01

SHA512
630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de

Download Submit
memory/976-152-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/976-28-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/976-153-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/976-34-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/976-114-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/976-113-0x0000000140000000-0x000000014036B000-memory.dmp

Filesize
3.4MB

Download
memory/2004-154-0x0000000140000000-0x0000000140374000-memory.dmp

Filesize
3.5MB

Download
memory/2004-21-0x00000001400B2000-0x00000001400B3000-memory.dmp

Filesize
4KB

Download
memory/2004-112-0x0000000140000000-0x0000000140374000-memory.dmp

Filesize
3.5MB

Download
memory/2004-20-0x0000000140000000-0x0000000140374000-memory.dmp

Filesize
3.5MB

Download
memory/3812-166-0x0000000140000000-0x0000000140242000-memory.dmp

Filesize
2.3MB

Download
memory/3812-75-0x0000000140000000-0x0000000140242000-memory.dmp

Filesize
2.3MB

Download
memory/4540-1-0x0000000001002000-0x0000000001003000-memory.dmp

Filesize
4KB

Download
memory/4540-2-0x0000000001000000-0x00000000011B0000-memory.dmp

Filesize
1.7MB

Download
memory/4540-0-0x0000000001000000-0x00000000011B0000-memory.dmp

Filesize
1.7MB

Download
memory/4588-146-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/4588-155-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/4588-62-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/4588-60-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/4864-36-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/4864-37-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/4864-61-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download