33668692ad696856f95471e2b2834d75ff6ab285fe1a5d9098d340362e127454

Analysis

max time kernel
145s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:10

Target

WinThruster/WinThruster.exe
Size

10.3MB
MD5

89b970cb172b86730c76c3df31551767
SHA1

0ae55b3a41e4fc1c3074dbb738065ac4cd2309e5
SHA256

7e97fe6c675e5842f38514056b2c3c7a928185f4dd2cdd97cd0d0ee4d5d319fd
SHA512

18b0416e3120e1554845153f988a5757e3d03605e729450f93393611566cbc6f904b9acae6ffabafdef673c2d1b4b77fb688f27ab7437eec5428fb48aad246ba
SSDEEP

98304:RDw3Ni9wMMTis0Vu2KKHGAmm3X+A3G8ZyUC3EQED2enKAcOe9z3eH4l40Mffh/b:G3Ni9zzFmmBgUUk9MOe9yObMXh/b

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WinThruster.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WinThruster.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WinThruster.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2612 schtasks.exe

pid	process
2612	schtasks.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

WTNotifications.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WTNotifications.exe

pid process

2812 WTNotifications.exe
2812 WTNotifications.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

WTNotifications.exe

pid process

2812 WTNotifications.exe
2812 WTNotifications.exe

pid	process
2812	WTNotifications.exe
2812	WTNotifications.exe

pid	process
2812	WTNotifications.exe
2812	WTNotifications.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

WinThruster.exe

description	pid	process	target process
PID 1492 wrote to memory of 2612	1492	WinThruster.exe	schtasks.exe
PID 1492 wrote to memory of 2612	1492	WinThruster.exe	schtasks.exe
PID 1492 wrote to memory of 2612	1492	WinThruster.exe	schtasks.exe
PID 1492 wrote to memory of 2612	1492	WinThruster.exe	schtasks.exe
PID 1492 wrote to memory of 2812	1492	WinThruster.exe	WTNotifications.exe
PID 1492 wrote to memory of 2812	1492	WinThruster.exe	WTNotifications.exe
PID 1492 wrote to memory of 2812	1492	WinThruster.exe	WTNotifications.exe
PID 1492 wrote to memory of 2812	1492	WinThruster.exe	WTNotifications.exe

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "WinThruster automatic scan and notifications" /TR "\"C:\Users\Admin\AppData\Local\Temp\WinThruster\WTNotifications.exe\"" /SC ONLOGON /RL HIGHEST /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Users\Admin\AppData\Roaming\WinThruster\Log\Tasks.log
Filesize
319B

MD5
bab02c88e7e8ba2736bef437be891004

SHA1
c23e65bc24db36fef36170cb3b17f26f43050d0c

SHA256
5ebd172e57ada9d36e36c342e098785ba4a85ef90d9225a933e274fe3d947eed

SHA512
de62af4d2831b488a8c88737a7edb7aa319c021a33b82f02bc20080dceb9c06724f62beb4fab676073cf608b4ebd227d132f7e270e522359be25ac76eddb1939

Download Submit
memory/1492-0-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1492-30-0x0000000061E00000-0x0000000061EF4000-memory.dmp

Filesize
976KB

Download
memory/1492-29-0x0000000000390000-0x0000000000DEE000-memory.dmp

Filesize
10.4MB

Download
memory/1492-35-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2812-32-0x0000000061E00000-0x0000000061EF4000-memory.dmp

Filesize
976KB

Download
memory/2812-31-0x0000000000B10000-0x0000000001011000-memory.dmp

Filesize
5.0MB

Download
memory/2812-40-0x0000000000B10000-0x0000000001011000-memory.dmp

Filesize
5.0MB

Download
memory/2812-48-0x0000000000B10000-0x0000000001011000-memory.dmp

Filesize
5.0MB

Download