545403ae8941712ac4f021d5867ac8df35a554d5754192c54da66f7b2a2d4e5f

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

691fe746ab84ce9cc21d871e1c3f9b24.exe
Size

574KB
MD5

691fe746ab84ce9cc21d871e1c3f9b24
SHA1

66ec1c5e597ce2741af432237c9f0ef27cdf4265
SHA256

ea635a9114326ba4fdd939ca2f45d12571a18ae694843fafb0cb12d249625393
SHA512

01c7578a8700100ba4d698ac605dc4d09e0c396deaa43b6adfffeb4501b8afa2ff2126aa3ba6061ca7e62555210603baacfcfbb210aa9bebe8e301e519135800
SSDEEP

12288:cwWK5MOiV1fRABtvKh8DVc6+n6s846x5v+ENaaSmsVUsEzM5H2b/LkR:cg5MOiXfR8tvM8DVcB6x5voBmskO

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2888	powershell.exe
2696	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2520 set thread context of 2668	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	691fe746ab84ce9cc21d871e1c3f9b24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	691fe746ab84ce9cc21d871e1c3f9b24.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2520	691fe746ab84ce9cc21d871e1c3f9b24.exe
2520	691fe746ab84ce9cc21d871e1c3f9b24.exe
2888	powershell.exe
2696	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2668	691fe746ab84ce9cc21d871e1c3f9b24.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2888	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	31
PID 2520 wrote to memory of 2888	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	31
PID 2520 wrote to memory of 2888	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	31
PID 2520 wrote to memory of 2888	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	31
PID 2520 wrote to memory of 2696	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	33
PID 2520 wrote to memory of 2696	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	33
PID 2520 wrote to memory of 2696	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	33
PID 2520 wrote to memory of 2696	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	33
PID 2520 wrote to memory of 2796	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	35
PID 2520 wrote to memory of 2796	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	35
PID 2520 wrote to memory of 2796	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	35
PID 2520 wrote to memory of 2796	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	35
PID 2520 wrote to memory of 2668	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	37
PID 2520 wrote to memory of 2668	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	37
PID 2520 wrote to memory of 2668	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	37
PID 2520 wrote to memory of 2668	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	37
PID 2520 wrote to memory of 2668	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	37
PID 2520 wrote to memory of 2668	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	37
PID 2520 wrote to memory of 2668	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	37
PID 2520 wrote to memory of 2668	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	37
PID 2520 wrote to memory of 2668	2520	691fe746ab84ce9cc21d871e1c3f9b24.exe	37

C:\Users\Admin\AppData\Local\Temp\691fe746ab84ce9cc21d871e1c3f9b24.exe
"C:\Users\Admin\AppData\Local\Temp\691fe746ab84ce9cc21d871e1c3f9b24.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\691fe746ab84ce9cc21d871e1c3f9b24.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JtRjWrtCUi.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JtRjWrtCUi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF26A.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\691fe746ab84ce9cc21d871e1c3f9b24.exe
  "C:\Users\Admin\AppData\Local\Temp\691fe746ab84ce9cc21d871e1c3f9b24.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF26A.tmp

Filesize
1KB

MD5
5c4970e220f89a2feb22854963fb9d26

SHA1
a492fdba5489458d90907df1f0999754074b95e9

SHA256
b0d8905c8602de3bd97bb5aa9ab4c20b8d9e3a22857c1bedd4a2ff84cee44529

SHA512
7cb9c040a5b46b4ee2f652f16813d1af6494a625e3aaa911603020ac99a1e7de231c19dc8e2b661400b00493491b59c7aac606173ced3883da055eadf18a2fe5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f1a5c40d8ceb3d5b66de7d809bff6169

SHA1
83d9c517f9d4f979be42aa4fb6b20d63dbf51c12

SHA256
e04e0efde5825fd3f53a8629fa1e196f08acbde812d361bf71ddbf1e8f25a2fe

SHA512
aaeea416e2f09d8faa095b46a5c1f44c1923b7a75feb4eea0cbb5ff8fd6751dcbca7b936577e4994eb6108e613281d0c0a2ce769815c8a547d2c2082fe3c2c0b

Download Submit
memory/2520-4-0x000000007411E000-0x000000007411F000-memory.dmp

Filesize
4KB

Download
memory/2520-31-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2520-0-0x000000007411E000-0x000000007411F000-memory.dmp

Filesize
4KB

Download
memory/2520-5-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2520-6-0x0000000007120000-0x0000000007180000-memory.dmp

Filesize
384KB

Download
memory/2520-2-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2520-1-0x0000000000FF0000-0x0000000001082000-memory.dmp

Filesize
584KB

Download
memory/2520-3-0x0000000000520000-0x0000000000530000-memory.dmp

Filesize
64KB

Download
memory/2668-19-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2668-30-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2668-29-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2668-28-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2668-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-25-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2668-23-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2668-21-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download