Analysis
-
max time kernel
15s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
29/10/2023, 02:07
General
-
Target
c3c3a0b9e2637af4d73654ec1e8937d0.exe
-
Size
1.2MB
-
MD5
c3c3a0b9e2637af4d73654ec1e8937d0
-
SHA1
4c99b6e1fc940304e444637335868db8d51a47cb
-
SHA256
d9b20209d1732768457a9e7a42a30e4c8732ab0fd1f75c12e7bd5b8e4ba96f11
-
SHA512
7d28914f25d08a8b1571457a44390550439afca887c7cd562d36aec6965f4e9ea3db0e5d40afebdbd37622b11aa47cc33631a51ad72fcb5d0f13d61502a17526
-
SSDEEP
12288:QutlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Qutl11tmlNQ2OnBdFQtP51llPup33kT
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 42 IoCs
-
Drops file in Windows directory 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3c3a0b9e2637af4d73654ec1e8937d0.exe"C:\Users\Admin\AppData\Local\Temp\c3c3a0b9e2637af4d73654ec1e8937d0.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a59710fbc072aaf76b2cd99ec8a2cef3
SHA1c08551ac5f15feb0b8f75ef5fc9e55bc8ff644b1
SHA25696185ec415e1e1fc24440cbdc3f7b81e80dac3c7e84755cf8f8c60218e4a0249
SHA512cf79a9b1654fd4b7d61750643511a23be3145e47c61cb6eea52d05ee3bf8593613e38a3e7f98ec9ac04eb030935ff543023b631d9d7f2a8e187e74d7897ead68
-
Filesize
1.4MB
MD5723db8e466e569dc815a384e306a3799
SHA1fd4b9b8212eb9067e255e7c348b2776be3f86faa
SHA256a516b1fe76f63d0329f6630cfae00d7028b5d45c95de429d17a5b029bd8eb7e7
SHA5123620c9fa9f2b6f1fd835978c2d0e3e34c38366eec2572fdf27e4263f1ab7907ae6780ff6baaa35b81f9a41eae637f2e9745e032407fdb9fe807e30002e0f73e7
-
Filesize
1.4MB
MD5774d5ba28e57f6c1736136fe8cc42d55
SHA1ab3824c4b7ae794997d34f8ccf084b620e6dc52a
SHA2561cc1faed0eec7109b71156ce32acc8d376f779defd40db561f1e56e4a53e667a
SHA512fb5a312da9cc0a0d2386536357a0fa985c0daf433e298987f721bd47d438115740845838d629674f77ba52bce427ae3ac7dc0d8a7562ac4c766eec80c9ed1aab
-
Filesize
2.1MB
MD58df467872012787be009e60164a7f7a2
SHA10b53710728ee88b023a058405807bd2111910037
SHA256cf4f88f0de8e2cee5b615222eda06781f46b1815ffa140994b47b36b8affd580
SHA5129087254e15021e5eeff77e6b2dd35998e00d04f5fde4724ed19ee9d191cc51ab9ba6221a444dab1282fbaff363073ac1c0ff39c9bbfa0c09f61465dd14a988af
-
Filesize
1.2MB
MD5df6cf216a2ee99bd877fb0c3bb039713
SHA16bfcad6a0ae62551ce8819b067f8425c6ccb3710
SHA25637f4e26a708f222f0c96382ab7a35b717a75d35f598bb4e4fc365e05c6f9cf16
SHA5125109a895b68ca25ae398847dd61f45f78482cbb57769c9704a321c17499cab4340ec32a1e8f611c97e2df527ed5c6d526da614c24315536dfa7f647ebc28e98d
-
Filesize
1.7MB
MD5942edeb747e31525f3df18c225fd5562
SHA134484d6ab00449ae7acf7429c6ae132076cb2393
SHA256c6cb70c33ea7237482bcfd3deb81527809e3b0831c74fbe2e9b6bb387c8e2f0d
SHA5129e69f8482ab114af8989dcf333b6e7582a9b5634bba046acb938e21460d9b2d331fbe4a6ce909a68f36316f7bf56b2526c5085ce149bbec6e4cb09d24f643f08
-
Filesize
1.3MB
MD572dec8edf462c6544fb357aa213e1c2f
SHA1a39ef50ad2d807a8dca1eec066e970e10e1e4cea
SHA2566699170f50e53a084f11fb56787e0bb03dac16bae7db9b06b5c0b193d3b2efe2
SHA5121c42b6975add2d09985a65b468f14f3164d84257c8e062de144d15b160ae4ea6fdc149ea5db934d3f293910f214498de85b333e9a97d9d481598f86b86378a0a
-
Filesize
1.2MB
MD59ff4a1f3cfe5f40ac9d28b77763d8a66
SHA11a313af2e677cf530ddf7443fe80a6102310eb28
SHA256981b722f857af3a8b0d3316906d586c0d2766c6d0b9f39fda50c6d8b53cc43e0
SHA5125f78666c5000b42e5651755dd8913234d212b3733424a31c9dbf7ef824abaa370b3b290c49dce67b02278d13e8da35e1cb00f8853c4b7d41b083c38ab0652bab
-
Filesize
1.2MB
MD565ff47991bb6c73c4fd4a501ae328b8c
SHA1c5c987b0bc2e7190afd1b90e7d9c2751af935558
SHA256ff34966dc0e5b658398b09a497df5ae20e3b45caf7d0246cc37f8e83c4559b4c
SHA512b03a6ee5a9b8927b1cd5576436181b556e7395a5e70034d4d949bbacc3340e3224f808ad3aaebe51ffe31cb156b92096b3902105840cbaca383c603bed430a10
-
Filesize
1.5MB
MD5783828e6c4d8f2e97f740be004a46645
SHA1dd3d72f8e3a1147dcb37946b3b21126afe4c0242
SHA256316e204b094b5cf2dc4b16dd2e8fdbfe3dcd594b405a31d7a7c4db10d07afef4
SHA512b7927845a86d60f99f155a5dd5f7242a3830ba1270f049f410e3558b7a403a2c19ec4b824a18150b6aced0dde9cd9061f8c49530ded11ec8d1a8d349e0af9ee0
-
Filesize
1.5MB
MD5783828e6c4d8f2e97f740be004a46645
SHA1dd3d72f8e3a1147dcb37946b3b21126afe4c0242
SHA256316e204b094b5cf2dc4b16dd2e8fdbfe3dcd594b405a31d7a7c4db10d07afef4
SHA512b7927845a86d60f99f155a5dd5f7242a3830ba1270f049f410e3558b7a403a2c19ec4b824a18150b6aced0dde9cd9061f8c49530ded11ec8d1a8d349e0af9ee0
-
Filesize
1.3MB
MD5b940c660db3d6e7ca294d3e7ef6a9358
SHA128be1577a1c2f202c88b4fd52d92f2d97df331f9
SHA256e3e69c8a21c87513216cd9b8386b4ff3e3fac9ccc8bd2c9d5127f82661fc866b
SHA512dedd202fb1fd171b075a207cc63b2fdc66523bc3414bfa9cc0cf7c3689bd1051e472c9754a76b994548f0300626995c70f4c30c0104ea334d3d4da3091383450
-
Filesize
1.4MB
MD58e7d1a04561f765453691eb3e4af8a76
SHA11b0e742b3fd3b0b226f0fb84c6a90f4d9249bdb6
SHA2564a0670330fcff2b2ba0f366fb93bb25b754bd33737225b77747ce81757cb7795
SHA512885534bed94709362d78c113ebbd4b4bb52f6802981538f5e45d12cb3e47f83408a60e87efa5b5c999e345f507b2928b1174cc6bb7b483b2add7bf46b13e28d3
-
Filesize
1.8MB
MD59b6007986568d27ca6366ac3564e1631
SHA1b934b5909af837f9ab672595bda2c8b2570ae57a
SHA256a975e1a28451193b65239c153ea8c1efc4787cd7fa4716fd3978f1b7c12ff7a2
SHA512ff086b66683117cd6200dd6285678a2a9c314492189842686c35c648519cfa005d38fabb52672086d6b18b8fc3f8e7ce6825c953ac2f47b0f77b169c343e4999
-
Filesize
1.4MB
MD5619df72a954bf79944af4a181f562bd6
SHA14476c51f13073ce7a19c384491c471fffaf14704
SHA256bc88597c3ad8901954e7585f4a4686c4eda73fe7326a6c8e3538d60b17ffe5a3
SHA512daf7b56ff634fb6b857b51e3ce1d8ecd4fbbd0ad5f3a9c430b90b4868b0129042ded1249a0b48006341f54fcd23ea886ae0c1ee9862482f91f32a961c6099c94
-
Filesize
1.5MB
MD52c0670edfa1976cdb78ed27f7b03799e
SHA1d718fded0dd90f20e269ad0b41e9f690a01aeec9
SHA25695e639ee06e289720268168fbd4b808b9e30810935fdbd79d1bab5a6cf798883
SHA512026961492f297e48274d599198a22bbc4e096c2aab9282a3b89388bb7555e2bc008b6b513c224d239bdba1a873426305d7252d96be8d7bf79f871f2abffb57ca
-
Filesize
2.0MB
MD57d707926c027180d4ab5cfeb8e7091c4
SHA1d50e5e49236b97507ac5572566d72982eeaf0a20
SHA2566c26f9abf6a3417a329d9180aa5ec84f588da90675fbed20bc1b505027427014
SHA512b8bc658cf47890c2173033e1487a69fb0012dd717eae09eff845e3ac8117e2b93451b689106df7870abb091e99b666c7a94adbe6a36daa5a3355685efe17f5d4
-
Filesize
1.3MB
MD5ebe07cf09526c368cbab08d30a05c40d
SHA1e3ed910423df9eea5637a9b2e908799d3c9f4bb2
SHA2568a41212139515a21f088b6d2c80b4f2817a52888b1ef3a6d8fdb184283b0b0d9
SHA512b3cbf8a19ee96b2297f0fdec968a902d463af09c5a311e86be5d75ed065f913941318e5be93ebbb312994f9cc12f343858ddd64c9526fa6df94f22d75a29abe0
-
Filesize
1.3MB
MD55127dd698f7d1c2e81d9fc81d2239afb
SHA1abbcf0536248491d0a84533cc396223b1b299a13
SHA25653b0d442a35cfc9b85a698b854dcddd1c6727d65ad0bc26197b0ba0cd7080891
SHA512b7f580be8d4391cf34d93ae022a2485eb68f6566a6dfc4af6d011f8d707d4128b45371540146a5a4a0ad2e85cb65df4a4b9368a12a6455c53acaa7aba70b2999
-
Filesize
1.2MB
MD5ad2c0f3984f32279fa25de520936a7ba
SHA11882d78ab3b0ce677b316814439df072ffeccc86
SHA256fcb00c8b76a96a310d349c1d4420e6685360b7edf52ad00d194b91898b68e150
SHA512d2e2673eebe67cd8c54162e0845423c15d0bb2df956507ced94a5514297f203dab735a22204cea39ba3132fcaf1d1f1bf5166b5199f45b8d7298528bb4176bea
-
Filesize
1.3MB
MD579e69547622bf584274c9b559ac81480
SHA120403be1be9d8f4f52a4660c013cd22082229b44
SHA256bb4553f946e5c963bbc4236dc513460f94d81b45ad983b3ca0fbdb3411548ade
SHA512012a45de8cb06e20fc3c561e7c1235cd22b9584e838db5e87fc13a44751f47687495e5e93040e211375bb1877726db3667d05797c69da41ee3f145f4c16d98c7
-
Filesize
1.4MB
MD518bd8974f8c8100da33a06d7bfac49d7
SHA13620c877afcee636c117da14d0c5c8ca288a61db
SHA25695cd004ff38f2820d0cf9d6efdd77417128b3321c8a28855be1d8216306ea82e
SHA512c5098822b295bf5f165bc8d69d4d028a449d7a2e3d5e94370b669a79c450384ec70e46519f26947924c08631290e43fa345a22834d507609152ee718ae69b68e
-
Filesize
2.1MB
MD524be8be4d1e39405106268bb6a8c2b96
SHA1929eb7e3de7ab88cdfa3e309b43ca6487a73e832
SHA2566f68b4569f151561c728afcb63080d25104d104446d901503fd620ff6f95fc1a
SHA512fd9eeb1e68194dc32d59fbd73d4ae801f449340f9f24495de7274b61bd532cfe652303a2be619a444357e415b27939b16e455176664739d0903b678997e5bbf4
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.8MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
1.2MB
-
Filesize
1.2MB