Analysis
-
max time kernel
176s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
31/10/2023, 21:26
General
-
Target
e7b49ccb3a84e14c86e319be2fc6ca3743b72fb9a2180cfa462ddef18cd3eb6d.exe
-
Size
1.3MB
-
MD5
22ceed31ecc7cde3c47e0acfac065a2c
-
SHA1
7aabe31fd8eee06700c611eb4666891c5ddd0f2e
-
SHA256
e7b49ccb3a84e14c86e319be2fc6ca3743b72fb9a2180cfa462ddef18cd3eb6d
-
SHA512
ba86e32f571e16631339f56589639f1aa4e77d3e1ccf63bdc140dcfafdc42f445ec49630154fef7ec42b301852725bfea2ad9fca6460c0945e198f1dfaffc53e
-
SSDEEP
24576:G/CKAB67ozX0j52pMkuLoiSJVlIL29mhNq6:GaKkL70jIpM3kiSBM29mhNq
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7b49ccb3a84e14c86e319be2fc6ca3743b72fb9a2180cfa462ddef18cd3eb6d.exe"C:\Users\Admin\AppData\Local\Temp\e7b49ccb3a84e14c86e319be2fc6ca3743b72fb9a2180cfa462ddef18cd3eb6d.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD540d36cccf2a3ef19cd42901c702413bb
SHA1246c29bd8c9420ee74f8f487017c4b8d68d7acde
SHA256ceb122761bfcf488a5635383a271417b37a2964ee1a0b2af5ed7959f7bdaed41
SHA512df01a49262a7775badb4fd8e6060b1bcf0b358a2024250ef68d3a0ac9c4fa5c4181b6184ac21e9b2ad8898f7a7af4260ef47270de655707ffef63b28abdeabb9
-
Filesize
1.4MB
MD5477261ac08f75f63810da0f25d0c938e
SHA130f7f55f4c77c393cc7b0ae6b8f14aa6fddd01b6
SHA25638abd77f9a02b7b0e88770802ec8b255edbb45110b11119fc56d54041354c61f
SHA5124593c9b7d537a8f09aa5d4f26253be155716e67c7a515e1378ccc2cf183541d86ec8a2b46e8d1a13e8786884f4846c354b8811d1a4d546f98421199b63cf8f46
-
Filesize
1.4MB
MD594a086680aeb00bf5ec9383c2f783f57
SHA1114a6af3a710f94fe19a5e1ae7c7a910571114c5
SHA25656a2626cd01ee0d37938eb1e37461c428d7cff76209483687d58c3d038646137
SHA51246d79a0ae990e9808f437478729861ee6b184ef4b7be8698fc009f2606ee907540c8061a3cc2c58a2af422f74c46793a712b84e39e48c89ed65fba8c5d777a10
-
Filesize
2.1MB
MD535cbe68efafc4a2a504d3c9bdc4fa630
SHA1f8b3cd428933490c2cbdaa3193af9b5a613aaf38
SHA2567d1aa123f4f70565ea791250f3c97fc26d6de14ae8ac0858e1c4307bb42a7f6a
SHA51287851bbc222d0be567827ef75805ca56422e0fb93acc8ea44d74c176de7caee597a1ffa2e1859f54222338fc27476b439a87b93a0cf2baa91590fabd30ff14b4
-
Filesize
1.3MB
MD5fc62da989794010e04378ac1711939ed
SHA14929fcb3bb630403dc7de20e2648af6bb93d5d5c
SHA256abc3b01f41e8b557f3f3d8bdce84855484df86292d8a94d314dbf8e95c25c02f
SHA5122abf7c18c40b285d2a0be4986da4384f218b211000fdd118f8407b97ff0ef4282f0dfbe32456cd030591b9ba0183044a101ddb3ed4eec62f464883563bdb5680
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB