030398c647a53a92acea6295934074801006767a34d799b964b50b4c61930a84

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2023, 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

030398c647a53a92acea6295934074801006767a34d799b964b50b4c61930a84.exe
Size

3.1MB
MD5

29bb9b81e6a706cb7b6f6bf4a2b14fb9
SHA1

662fee082b92d1162872546c39da18a90e977d13
SHA256

030398c647a53a92acea6295934074801006767a34d799b964b50b4c61930a84
SHA512

98ab74a944ba18a0f4f020f252b1c0fa16b8fbca80d05dd6bf4d5a9de2230a1fcbdb1a003969fda8e84a9627de2ecfaad21fea721aee88ebb534ecec03b73ffb
SSDEEP

49152:tuXBBl8txcIaxA8PlC7xAbhFY6SDP5wMiiiiiiiiiiiiiiiiiiiiiiiiii4jwLNF:t+umG6bhE6G7wRGpj3

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1912	alg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	030398c647a53a92acea6295934074801006767a34d799b964b50b4c61930a84.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	030398c647a53a92acea6295934074801006767a34d799b964b50b4c61930a84.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4484	030398c647a53a92acea6295934074801006767a34d799b964b50b4c61930a84.exe

C:\Users\Admin\AppData\Local\Temp\030398c647a53a92acea6295934074801006767a34d799b964b50b4c61930a84.exe
"C:\Users\Admin\AppData\Local\Temp\030398c647a53a92acea6295934074801006767a34d799b964b50b4c61930a84.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
e28da4779daa8508f543214770dab209

SHA1
4701c62ea5d80f2113189617c25b1fc0b000ca76

SHA256
fb5f203c026dcd466ddbeb90eb9c152f0abcd54888803010066b5795bdd7008d

SHA512
2cf55c5fb5250e7ecbd212e1a308293f6809e687d348831ba35d78fddc161b7461100fcacc8cb7239b6169bc1e2be819c4a43b6ca62f14040f19d03159429429

Download Submit
memory/1912-14-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download
memory/1912-17-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download
memory/4484-1-0x0000000140000000-0x0000000140341000-memory.dmp

Filesize
3.3MB

Download
memory/4484-0-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/4484-8-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/4484-7-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/4484-13-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/4484-16-0x0000000140000000-0x0000000140341000-memory.dmp

Filesize
3.3MB

Download