7ed6a4025c47439d34299940d58cd30614da40f59c5ae61068aed835ee231dfe

General

Target

NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe
Size

625KB
MD5

e3598767c04dbff26c830cc60bcd5fd0
SHA1

2ba80ca4949f7e2af4ba9c21587c842157c47bbf
SHA256

7ed6a4025c47439d34299940d58cd30614da40f59c5ae61068aed835ee231dfe
SHA512

cfc4244f56887bec5ec819d60c96c87d5cbfa9ee086d2a198cb30a73063b770e48e007023c0cb2cfd038849a6fd28ba125fdc94ed828ac9e3768678476750b97
SSDEEP

12288:O2U9CqY8xewVHK6RgIZOWzxZqfny+LSe5/9qRA8YAC88iA0QWNtM:Lf8xNqPIDnITSe5/9jSC8A0LE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4268	alg.exe
1800	DiagnosticsHub.StandardCollector.Service.exe
3104	fxssvc.exe
1340	elevation_service.exe
2140	elevation_service.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe
File opened for modification	C:\Windows\system32\dllhost.exe	NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3ba8fac21f62b58d.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5108	NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe
Token: SeAuditPrivilege	3104	fxssvc.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e3598767c04dbff26c830cc60bcd5fd0_JC.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2408

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
045ba063a6fb70920cb160a9ce4001b7

SHA1
04ce557aaccdd3e45fc8f95addc69141aa57ffbe

SHA256
7a6f0dbb21c4b1bf06303b14a28103464fc7b03c4ee2b8192f525f1c07ad8bf7

SHA512
14afd6a29122548ae5b0371c5a4b24e86d4c4535c020d2a085852bab3b2e4a600c014aff7c146e3963e55a7f37bad4a650f9d51aa17eba1f385a2f7a938c9ef4

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
4e8eaf0cc98b2c25778f455cb02d2b29

SHA1
d2f6df6a0db07294123025559f175b17eeb75f8f

SHA256
fc49d4af5d01b072b2da86bba574a32097519169c2f5770f73c0b50de6dec8cf

SHA512
1902519b9f9372161bc6150b27c3487b5cb2416e468f2c13a09bfd4f695c12e37409c3eab3e78fd31776647fdc0d83f576a9ca338cdc3274a7d33f438fa27030

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
cc545ba9912f6724bf95a41c71dd6fec

SHA1
cd758df42c695207fdc10df035cbff6800ea7bef

SHA256
585bcc6b72b309c10dfe6527766c4d9055c2cf787abb1c56b5eb0d8419c6f014

SHA512
6736a034b45f6b26abd9f91b6cd875f020a68d296c811ef674e3e7d7a8e86f1dfc680994cf1a1a5c71f52bafc835a4641614128590e9551fc0d95fd88f738495

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
db35e804ecc1fed6ecafac1725d7b503

SHA1
44b5281a9fba0c1ea7b4caf5bb7efb8fa50952d8

SHA256
7de39bf4316e52fe2b4839aa83f64017f643b5182765a2337440f258f0e100bd

SHA512
0cb0273b89734e6d5f6849cede5c6afb2ff8bc4899cd5a7d321448a6da1b2e5e8c164532b0f3c9a142fea321ee472ffe4814ae2eb85f8622b7f30c824fff0712

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
17e59a3d33da230f9073e037c85b6caf

SHA1
e889eeb3019c889b11f51d0b362abe92507085ee

SHA256
3620aa35ffa974974a16cffc901b5ea7ab05d17e1bfa464290c0bfd41e7f2e6d

SHA512
bb5716d58bacaa2f8e95803ae81b051db378776a5f861ad6c58c602116767c499405dbe255883837a824eca8a5a0a6e43fbdb170c559bdbfe75375e979eb9714

Download Submit
memory/1340-32-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/1340-33-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1340-39-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/1800-16-0x0000000000720000-0x0000000000780000-memory.dmp

Filesize
384KB

Download
memory/1800-22-0x0000000000720000-0x0000000000780000-memory.dmp

Filesize
384KB

Download
memory/1800-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/2140-44-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/2140-52-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/2140-45-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3104-28-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3104-29-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4268-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/4268-40-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/5108-7-0x0000000002350000-0x00000000023B7000-memory.dmp

Filesize
412KB

Download
memory/5108-1-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/5108-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/5108-2-0x0000000002350000-0x00000000023B7000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing