Analysis
-
max time kernel
22s -
max time network
85s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
30-09-2023 14:31
General
-
Target
e956dcf8b25ccc0d1c61e40075cbe18cef9e22f1b58f79998bbf2638642a7815.exe
-
Size
1.3MB
-
MD5
67753ac9fe4f92b79506a40197db937e
-
SHA1
21221e792df2118cd16fa491c871058cef3105bd
-
SHA256
e956dcf8b25ccc0d1c61e40075cbe18cef9e22f1b58f79998bbf2638642a7815
-
SHA512
104bb766e506a3e3fd6efe6dc239d334a0fcd65cecbc2818ddddd7dcc4aeda6fef5318eb17ffc580aa44c5f591793d79ef699504c066857418b92f4e9aa5f41a
-
SSDEEP
24576:/iry1KswscUUk//tmUsDnpEYxky/+oBc63Fc:7pz//EDnpU6d
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 14 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e956dcf8b25ccc0d1c61e40075cbe18cef9e22f1b58f79998bbf2638642a7815.exe"C:\Users\Admin\AppData\Local\Temp\e956dcf8b25ccc0d1c61e40075cbe18cef9e22f1b58f79998bbf2638642a7815.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8962⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD598ba6482bd7b1c0734eddd4ec8fb9a1a
SHA17d1e9030c6d7b8307c498bf5ab9d984fc5891b38
SHA2569c57e09be0096d2f90d6c677b4c443cf96eead551ecef974d5d830ec45e66454
SHA512ad83e2dee92736186bd9623337acfdda427db3a58f31f841152788fc8f68fef6b79b36e2d8b65b919a10fb22cfdf3d2e5c27d760fc004c1c1f94561cf5c272a9
-
Filesize
1.5MB
MD55471edd37efcd3fa419ea591b9978b71
SHA1dadd1761f48cd583bf99767a1b34b42173c099b2
SHA2562c6c60dc2a5960af0e620c1b37a7451536147bfb9e9b3286b6711176842ff672
SHA512b2bcde44eb406e37cba3ce73befead00da7f1c13ad8e48b5a313144c4eeb5ca4de3a8e84c38827bf2b39ffcec3a2ec192626df1cac20344ed20a5c5a6280b515
-
Filesize
1.5MB
MD5844d0253b01e9f475eb7a210b4c1a13d
SHA19076788c487193c7f04d3b1f83c49ffc5616513f
SHA25601571206a7ee44763099e802a21ff9c0a8435488d10d01b8a0a075f7656326b7
SHA5127065161e41b259032c0bdf9fbb1395ddb0742613eabf26da3ecb4ba809d192502606f96d59effde444ced932b11884fd562ef12117e3d2b881fd22afa026285e
-
Filesize
2.1MB
MD545aa0a504c80da473691a4a67f11ec82
SHA1ac52a0e23e60a578f49a2a31f0a7a6a5a03100e9
SHA2562a04fe98b3848ccec62b46656297eb194e34d687982719df32e176aefa9d3ce6
SHA51234fda4195c48e510c9a999f5227583ffc5b42f42fdcf2f8110bbd85fbbbbe4baddaef04b0fc1c03be0cf634d45af430d257f36c01ff00615aa00eb8649cd4482
-
Filesize
1.3MB
MD51781ce865636395d2f9fa6bc66dfb01a
SHA1c908b667986c9051929c3ae41b23282599226350
SHA2561c7fc8922a1e60a79052051e4258746e7577a419320b8fb2e3bac5b2db621b16
SHA5122430a541b51e633a8b8b88ad2561a36d5f22e86b2e6447a3a8db39f8dbc97eb556b099efee62ffe18a74a47c31359d4325fef74c02e3165d0287957d97ac1563
-
Filesize
1.7MB
MD52460291458977ffbd4322fa509663a20
SHA1811eb441d4d03b2a76d8f54d4f8951c87263a0c8
SHA2562986b4820e1feb84e702de009c338b8198f50a7d6e27623a6efc703c6b36e3da
SHA5123377c25368c4266f2edba187bc0621ae98a8bfde1a3fafcccd544fda2473c9fcdcbbf052cb3ba456c694fb40c48674066894ebca12cbbd9a5086cf3320d7ebe9
-
Filesize
1.4MB
MD510dfecb6c92e6e9e2bcd43abfbadd9fb
SHA1e9b5fff573515f9bec9678c21de0988d2b044660
SHA256994f6e64f5a4dc767869cdcaddb7eae360689f579e87fd1c0f81c78974284c5d
SHA5123d25c59d455f930543f8ac263c624ec155f7a1f8e898eb48bd04432d8e6b7b4371571363060b26fe0187c5138b9a220ff18bf4eab5e84da100622af1c5f11e10
-
Filesize
1.2MB
MD5520cbfbec066db1fe5606560b143219d
SHA1b43d2ce0dc07643c1457d9bd6ea42833d0ac83bb
SHA256872b85c36540f58214332d77223a90fd2b79a2cfc7e0e820598ad0722aa8e4aa
SHA512cf96d19a8bfaccff187c3250646ea83ddce0bcb1bbc20d86c384fa3971ea03c627573daf69d143862e2fa2c07755bb9fa4944df6a8b0a54a64051cc44c21816f
-
Filesize
1.3MB
MD5d9659f9f83be2251d5fdda3bcd32dbad
SHA180adb783cd99c32b96b19407a68c1e8bb3ff1287
SHA2565dd9374fe4eee3b956c23edec5df273c0974dd851a39ed087771eedcc76d9e97
SHA5124ac89e86e0ae085e489cd8f21c3dce1ae700c48a6444278d23e08e1d54547ae30224d74c82c0c75b8ae2a3463195e878e2e3f2a80c8c13d270368b55086d0caf
-
Filesize
1.6MB
MD53e8518e270f4f2ee4d0ece54dd06a875
SHA1b675a09d2b2950088bc3332690ccc6bc0e5a9f24
SHA25671b56ff181d066aedbf0e17a969bb37e6327d9e95d6ed992429137f53e078fe0
SHA512a8ec693db09ab955a988f97e0350eabd99ac035d09893dcc795ee959990f1d7de21ed3cdd2cdf15461b720fe0be49a3b019a2356ab2eaaf088eb9c3245236b40
-
Filesize
1.6MB
MD53e8518e270f4f2ee4d0ece54dd06a875
SHA1b675a09d2b2950088bc3332690ccc6bc0e5a9f24
SHA25671b56ff181d066aedbf0e17a969bb37e6327d9e95d6ed992429137f53e078fe0
SHA512a8ec693db09ab955a988f97e0350eabd99ac035d09893dcc795ee959990f1d7de21ed3cdd2cdf15461b720fe0be49a3b019a2356ab2eaaf088eb9c3245236b40
-
Filesize
1.4MB
MD58cdfa927b09a3f2f717fbebf8963e7e4
SHA164dec37228d9eda1b85c4648904b65df2029c1b8
SHA256db5e7357d354798134eb682f3f0f458510f4c9e9ae873c79e24c005855e9935f
SHA5126ae3adcc8e25b39741d5f21820ee6d2521f39d93937a492be0869fb47e5c1e750df213da61922b0a96fe5664e8421d7cf13b6423cd18ea00fd8f8533a63835a9
-
Filesize
1.4MB
MD542bf7dbbedb2589c7a253c8edf31b195
SHA1a270dd8d889c5870cb8e8235279de52c6d76d2e7
SHA256518ccc7368647b61de5e429e33d35ddb6bfcaca14ae22e750ae6832252c0941b
SHA5127d2133ee84e8ed040833a96633e3c75000acad5bbe2312a0c46d873d95e68f3f14b35a1e34efc05933cd5a36ebb20da01654e91bf48ee761a83bf81bf0e23648
-
Filesize
1.8MB
MD54e9b8d9340ae52259cd86d50f00e536b
SHA1d6df5645541173853f6a0ec3dff194e985aeb2a5
SHA25610b0419ab70e380623e2c36c5a20e02f88407d7e45cd7dfc02656e4f96744203
SHA51275c7086134ee4d78866fbdc1d283df61738019f916979677c30cac93327b9afd0e7b899f45bc05bd77be38f1a2e89a3e98e1675b41da915ec07773b0c76f0434
-
Filesize
1.4MB
MD5be6a67aa69a62ebd6951d9c403d9474b
SHA1e64cfa9195e147973ad8a13c33166babf190367b
SHA2560babe306dcdbfa66f48086e3371084036149ea802f10c258fead87700d78518b
SHA512f74e3f23f292ce17d81e5b74049fb94ffd7c9e1d23274b8fd877ae102b982e05f2749295a26b56f4d714bfe1cc98edd1b0da439ed38eb6d5f3975b1641a11238
-
Filesize
1.6MB
MD58d6c138d555d228c20726abc571f0454
SHA1e3ffc25dde800e8d229a39c253505e9450c76f68
SHA2560a2f0251fcdc33e9e55555e682b471d01cc4229dc60acbfcb4094309311413ac
SHA512cd84db5c7c866ba5e1bdb2a4d6a86a117095d4aa137242bcff6adae32ba45695f2c47850d7fc88e94381ec65feb9822e12b85d77b388f27545f504f14fa3a78a
-
Filesize
2.0MB
MD5aeaa5dd1091c439c33a94f8da45db013
SHA14d44c26dcfc590219e943601357da2aa4702526d
SHA2561c653069e41fbc5e91e42ba9a901684ed8763082769258c3b0556c7afcb32652
SHA512d235ddde4084cfbb1c161c7668657c1c2f08ac80a74d4e1a8a1570a1fbba756879c391c0342dfb1545bd69d39f691730e66ba03ae20cb8959e8585825f6b3fb2
-
Filesize
1.4MB
MD5c722eeda3402d14329898e5d868b3901
SHA150ff5091ca637156b4e558cccb8bdf0da241b38b
SHA2569714d9e448f0471d538db00d5b77b692535c693b166364662f956a5f01ee06a0
SHA512012b48841a8e54f73bfe3c90f1fac67dba0f37efd8c8cf3c1ddc21fc06d23dfc154ff4b749ee5a7cbed0c9fb4ee6b04f5ef6dcdbcb6688765aec54fc255134b4
-
Filesize
1.4MB
MD5775c20451bee67d0ece135428662a861
SHA1cebffdf2f704c24fcae892cbb5e7df5f8e55fcbe
SHA256147c82fa2d1b7c5de905444b94becc509bc42b1f0e8847e5b48b13c4843b4b1b
SHA51207eb76115a3744dde13a2235236f0fa61240a269bba6b494cdac2c0678b6c9cb9dfe82c7ea75791a71c6cbf5225c8e664c5eab1135da0aec2a7298eb52349d98
-
Filesize
1.3MB
MD5ae43f49756bb162f6252fda19f5903cc
SHA1c877e63871b50c0db9cbfaa174b4adec899a3a60
SHA25625062fcbcafc1889eb7971a871ad87f942ab33952e8e46af0573028cdfadefaa
SHA512f95ec51cd3e40ea6a93188911c3f9d1b37d2640c04b6cae1303e4f8c03fd797fe3cc21e8328ae73c01546c92de824b426cfa635470a6e8e3420ce136bc0a64a9
-
Filesize
1.3MB
MD5187d82a1e9fad49b9fc0e401cb81c629
SHA11eed394d3d88933fa1e037a6505430041932fb94
SHA25689af436d0c6fb7f40d05378e24b59f146eb49cbf6247549177517536b2a0b4e0
SHA512f78e8f365bccdbe05f8716877b9ba1c6b45ed69a9c966cb61b80cc77abb1d219e24bb746a01510c0ddb4c787a5093fa8ffadfc018b5d810c54fcc68d220ba8ea
-
Filesize
1.5MB
MD533337af9f36f490ba85ad7e8000e268d
SHA102c356814e0ef3c8d4700acaf1547479944bb15b
SHA2567132d9316efe2a1b1acf5bfc72df7ae9efa0760913594c46f834738bc7a01263
SHA5126e43a1626c68d4a5c294d2b456fafd6e6d7ce50b696d19d97c44aaa2c8debb3e81821b923bf5e2bdfce0368ccb9c8413a0d3efdf6dea630922540d187ea7a7ca
-
Filesize
2.1MB
MD56c78e9a8e44fed6b712a37d980de62c9
SHA1bed0695685f75db90875871bd740b6f9198ce939
SHA256c84142e3abd1b9a684623bfec0667b30b1175043e12cd3173492bbd8feaae1f0
SHA512b2377e8ef11c6e475c225509b864a796930f7d5fe86d86bb5a06c2f00b0bd69bd5591aa0c4294846201de9e24a5b0c4429e176334332c316694a410da0c7c47e
-
Filesize
412KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.5MB
-
Filesize
384KB
-
Filesize
2.5MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB