54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe
Size

2.0MB
MD5

a9421faf1985369e29d62098607516e8
SHA1

6558ae4bc75d66329743cf49d93b27edaed24ec5
SHA256

54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0
SHA512

373d67dc48759f425d92505c009f4776741186e96c2cbccbe9cb605a8bec1f853370327e0c1cc3661ab6c8af0a57d8ba7aec130cd6f42b2ce208e0fb3dde2ff8
SSDEEP

49152:G2Acn9CkZ0X2hff/yC3G/9zzvNtstzVeW:cyrpR3fgzjOVeW

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1276-0-0x00000000006E0000-0x0000000000818000-memory.dmp	upx
behavioral2/memory/1276-35-0x00000000006E0000-0x0000000000818000-memory.dmp	upx

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\rdbuiIWn0.sys	SystemPropertiesPerformance.exe
File created	C:\Windows\System32\PrintIsolationHoster.sys	SystemPropertiesPerformance.exe
File created	C:\Windows\System32\wscapizd.sys	SystemPropertiesPerformance.exe
File created	C:\Windows\System32\nlhtmlpHXR.sys	SystemPropertiesPerformance.exe
File created	C:\Windows\System32\SecurityAndMaintenance_ErrorS9Vt.sys	SystemPropertiesPerformance.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowRedSystem844.log	SystemPropertiesPerformance.exe
File opened for modification	C:\Windows\WindowsShell1541.log	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe
File opened for modification	C:\Windows\WindowSystemNewUpdate70.log	Windows.Media.BackgroundPlayback.exe
File opened for modification	C:\Windows\WindowTerminalVaild87.log	Windows.Media.BackgroundPlayback.exe
File opened for modification	C:\Windows\WindowMicrosoftNET10.log	Windows.Media.BackgroundPlayback.exe
File opened for modification	C:\Windows\WindowsShell400158.log	Windows.Media.BackgroundPlayback.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe
404	SystemPropertiesPerformance.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe
Token: SeDebugPrivilege	4676	Windows.Media.BackgroundPlayback.exe
Token: SeIncBasePriorityPrivilege	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe
Token: SeDebugPrivilege	4676	Windows.Media.BackgroundPlayback.exe
Token: SeDebugPrivilege	4676	Windows.Media.BackgroundPlayback.exe
Token: SeDebugPrivilege	4676	Windows.Media.BackgroundPlayback.exe
Token: SeDebugPrivilege	4676	Windows.Media.BackgroundPlayback.exe
Token: SeDebugPrivilege	404	SystemPropertiesPerformance.exe
Token: SeDebugPrivilege	4676	Windows.Media.BackgroundPlayback.exe
Token: SeDebugPrivilege	4676	Windows.Media.BackgroundPlayback.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4676	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe	81
PID 1276 wrote to memory of 4676	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe	81
PID 1276 wrote to memory of 4676	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe	81
PID 1276 wrote to memory of 4676	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe	81
PID 1276 wrote to memory of 4676	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe	81
PID 1276 wrote to memory of 4676	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe	81
PID 1276 wrote to memory of 624	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe	87
PID 1276 wrote to memory of 624	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe	87
PID 1276 wrote to memory of 624	1276	54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe	87
PID 4676 wrote to memory of 404	4676	Windows.Media.BackgroundPlayback.exe	93
PID 4676 wrote to memory of 404	4676	Windows.Media.BackgroundPlayback.exe	93
PID 4676 wrote to memory of 404	4676	Windows.Media.BackgroundPlayback.exe	93
PID 4676 wrote to memory of 404	4676	Windows.Media.BackgroundPlayback.exe	93
PID 4676 wrote to memory of 404	4676	Windows.Media.BackgroundPlayback.exe	93
PID 4676 wrote to memory of 404	4676	Windows.Media.BackgroundPlayback.exe	93

C:\Users\Admin\AppData\Local\Temp\54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe
"C:\Users\Admin\AppData\Local\Temp\54571320426a0f36f419e5befe7ac5e3b49016d2dbc50ab885d21c28daa58dc0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe
  "C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\SysWOW64\SystemPropertiesPerformance.exe
    "C:\Windows\SysWOW64\SystemPropertiesPerformance.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\545713~1.EXE > nul
  2⤵
  PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\WindowRedSystem844.log

Filesize
7KB

MD5
d800c40c18c9a5a7f41e0e178c96cd56

SHA1
4d5b8b08a072bf3e646a048ea9749879ae7a49b6

SHA256
b45e0e3e2eeee48ced4f37af506c11a7eee2a4687bac7b15f518b5ec7601a5c2

SHA512
b91eac1668c1f22d7afab80e605347a0dfe4709a9d449b5482fc469636d07651a7f3f6cab86bce391b86a892c2b2293478802fabbe50d18be1c961b6046841df

Download Submit
C:\Windows\WindowSystemNewUpdate70.log

Filesize
6KB

MD5
8aba7add7d8469834393b4c1c1246a17

SHA1
ca59b75770ef6036e8e6743d6fa057f3dc5c8bb4

SHA256
c8c9695165968370112bf42f728f16d29c32f83aeded6fbbf8bf5530873c5f28

SHA512
a4dd3ffd0cf1b66eb62763de6fc174448d470b62582eb3c4c7747f215c6596452ebb8517b9f3f193f4ff72a198ec223a72819ce82f0c0d8528b5b099bcd2394c

Download Submit
memory/404-167-0x0000000010000000-0x0000000010601000-memory.dmp

Filesize
6.0MB

Download
memory/404-140-0x0000000010000000-0x0000000010601000-memory.dmp

Filesize
6.0MB

Download
memory/404-136-0x0000000010000000-0x0000000010601000-memory.dmp

Filesize
6.0MB

Download
memory/404-133-0x0000000010000000-0x0000000010601000-memory.dmp

Filesize
6.0MB

Download
memory/404-118-0x00000000014D0000-0x00000000014EB000-memory.dmp

Filesize
108KB

Download
memory/404-116-0x0000000000820000-0x0000000000E2C000-memory.dmp

Filesize
6.0MB

Download
memory/1276-0-0x00000000006E0000-0x0000000000818000-memory.dmp

Filesize
1.2MB

Download
memory/1276-35-0x00000000006E0000-0x0000000000818000-memory.dmp

Filesize
1.2MB

Download
memory/4676-27-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-74-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-29-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-28-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-30-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-32-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-22-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-37-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-39-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-40-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-41-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-42-0x0000000002CF0000-0x0000000002DE9000-memory.dmp

Filesize
996KB

Download
memory/4676-50-0x0000000002CF0000-0x0000000002DE9000-memory.dmp

Filesize
996KB

Download
memory/4676-51-0x0000000002CF0000-0x0000000002DE9000-memory.dmp

Filesize
996KB

Download
memory/4676-66-0x00000000030D0000-0x0000000003136000-memory.dmp

Filesize
408KB

Download
memory/4676-63-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-57-0x0000000003180000-0x00000000031B8000-memory.dmp

Filesize
224KB

Download
memory/4676-55-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-54-0x0000000002CF0000-0x0000000002DE9000-memory.dmp

Filesize
996KB

Download
memory/4676-25-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-77-0x0000000005200000-0x00000000056D9000-memory.dmp

Filesize
4.8MB

Download
memory/4676-82-0x0000000002CF0000-0x0000000002DE9000-memory.dmp

Filesize
996KB

Download
memory/4676-20-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-18-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-16-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-8-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/4676-7-0x0000000000AB0000-0x0000000000ACB000-memory.dmp

Filesize
108KB

Download
memory/4676-161-0x0000000002CF0000-0x0000000002DE9000-memory.dmp

Filesize
996KB

Download
memory/4676-3-0x0000000000AB0000-0x0000000000ACB000-memory.dmp

Filesize
108KB

Download
memory/4676-5-0x0000000000AB0000-0x0000000000ACB000-memory.dmp

Filesize
108KB

Download
memory/4676-2-0x0000000000800000-0x0000000000908000-memory.dmp

Filesize
1.0MB

Download
memory/4676-281-0x00000000079E0000-0x0000000007D64000-memory.dmp

Filesize
3.5MB

Download
memory/4676-284-0x00000000079E0000-0x0000000007D67000-memory.dmp

Filesize
3.5MB

Download
memory/4676-296-0x0000000007FE0000-0x0000000008363000-memory.dmp

Filesize
3.5MB

Download
memory/4676-307-0x00000000079E0000-0x0000000007D64000-memory.dmp

Filesize
3.5MB

Download
memory/4676-308-0x00000000079E0000-0x0000000007D67000-memory.dmp

Filesize
3.5MB

Download
memory/4676-309-0x0000000007FE0000-0x0000000008363000-memory.dmp

Filesize
3.5MB

Download