Analysis

  • max time kernel
    120s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 19:17

General

  • Target

    1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe

  • Size

    124KB

  • MD5

    0d44e21cc26806ba9cefb553fd25327e

  • SHA1

    4039bc7941bce053c73d41df50a8267eaeded1f9

  • SHA256

    1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227

  • SHA512

    170c1d68c59dbf7b8d4eaeab14f15a4d5e2611f0f34408f9828ed96ce1ff5a34972d3cba1a11d1a4f9fc62a3089ec17b5bd07df98eced11a8a8135cdc8278e4c

  • SSDEEP

    1536:s1qcQMheJwmbKSyVfwT5xvOt0rPQ4llm6JMBtD4iJu/KS7b9qrFaiAOa0kHNPVe2:e9hYUMI44Vu/fv9YpnUpVky

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 4 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 14 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe
    "C:\Users\Admin\AppData\Local\Temp\1cfe1a7aba823646997f3f2c5bd65eedfa8801566ceccce758637d1baa15a227.exe"
    1⤵
    • Modifies firewall policy service
    • Adds policy Run key to start application
    • Sets service image path in registry
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    PID:3756

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\msrpc.exe

          Filesize

          124KB

          MD5

          dfd6768390ce065fbf9039f5925737c3

          SHA1

          c6ebb6d7c4b1721ca9c6275b37d02e4a540de873

          SHA256

          d4b3c2c520d34ae0002abebe22ec1707175be4682abbf9282436354466ada9e8

          SHA512

          6ca13f23ce336fed25296d5281311f3e0dc43aa15214534591ee0a3d72e2785b46ba673c594a90dcb15a57d14cbe0209f42d80b2f112c8ccf11704918d60afd2

        • memory/3756-0-0x0000000000400000-0x0000000000425000-memory.dmp

          Filesize

          148KB

        • memory/3756-17-0x0000000000400000-0x0000000000425000-memory.dmp

          Filesize

          148KB

        • memory/3756-20-0x0000000000400000-0x0000000000425000-memory.dmp

          Filesize

          148KB

        • memory/3756-25-0x0000000000400000-0x0000000000425000-memory.dmp

          Filesize

          148KB

        • memory/3756-27-0x0000000000400000-0x0000000000425000-memory.dmp

          Filesize

          148KB

        • memory/3756-28-0x0000000000400000-0x0000000000425000-memory.dmp

          Filesize

          148KB

        • memory/3756-30-0x0000000000400000-0x0000000000425000-memory.dmp

          Filesize

          148KB