Overview

overview

7

Static

static

3

0358a5e6cd...39.exe

windows7-x64

7

0358a5e6cd...39.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    1s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 03:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0358a5e6cd355452c2ba03bf34647939.exe

  • Size

    314KB

  • MD5

    0358a5e6cd355452c2ba03bf34647939

  • SHA1

    5c71dbf54a9e6ba1237bea6aa04a0f3f04dd6a61

  • SHA256

    7e79a0c950f0086ebed76cde6bd4dc6853354461ae03eaf8cda53e2350226a0c

  • SHA512

    2e4ac3b428b28d466800065904f3d0ea0e4eb3f390590d5d1ec44e6544b07592fab71cd93ea2e4639161afa273faf95e4ba4161af0627797e9c3277b309b41c4

  • SSDEEP

    6144:hTOGiA9k6j6AvSHlFYlfNad5+LKh086tMhadfWx65vP59c1:N1zvSFMNBKh0xtI+f1t59W

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0358a5e6cd355452c2ba03bf34647939.exe
    "C:\Users\Admin\AppData\Local\Temp\0358a5e6cd355452c2ba03bf34647939.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3700
    • C:\Users\Admin\AppData\Local\Temp\Qr0i.exe
      "C:\Users\Admin\AppData\Local\Temp\Qr0i.exe"
      2⤵
        PID:3004
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Qr0i.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
          3⤵
            PID:4796
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbe41e46f8,0x7ffbe41e4708,0x7ffbe41e4718
              4⤵
                PID:3788
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
                4⤵
                  PID:1296
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
                  4⤵
                    PID:1272
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                    4⤵
                      PID:2380
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
                      4⤵
                        PID:4596
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
                        4⤵
                          PID:2324
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
                          4⤵
                            PID:4364
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
                            4⤵
                              PID:3076
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
                              4⤵
                                PID:1160
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
                                4⤵
                                  PID:4336
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
                                  4⤵
                                    PID:4696
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
                                    4⤵
                                      PID:5224
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
                                      4⤵
                                        PID:5232
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
                                        4⤵
                                          PID:5648
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                                          4⤵
                                            PID:5748
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,8939099373446120564,4344440970875221384,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5320 /prefetch:2
                                            4⤵
                                              PID:3772
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Qr0i.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
                                            3⤵
                                              PID:5576
                                          • C:\Users\Admin\AppData\Local\Temp\En9e8.exe
                                            "C:\Users\Admin\AppData\Local\Temp\En9e8.exe"
                                            2⤵
                                              PID:4528
                                              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                dw20.exe -x -s 1304
                                                3⤵
                                                  PID:3284
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:2488
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:3284
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe41e46f8,0x7ffbe41e4708,0x7ffbe41e4718
                                                  1⤵
                                                    PID:5596

                                                  Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Temp\Qr0i.exe
                                                          Filesize

                                                          72KB

                                                          MD5

                                                          31db3a37716e014ece3fc35de48d2565

                                                          SHA1

                                                          f625c546ded9ac0e444638cb4a3e03cb8c7bdbb3

                                                          SHA256

                                                          6ec95cd32b0d4cbbeb225981154e25ceaebed5a8a547af02fc04088b2a3bb40d

                                                          SHA512

                                                          0bd6f0498b82d6ce6b7f5126aba3b2802cb590fded7c0e11068d45e605fc9f294e4ade864bc79af88b7a0b9145ec0735782cf80b1ab34d7277b8a3e2ed334078

                                                          Download Submit

                                                        • memory/3700-8-0x0000000001370000-0x0000000001380000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3700-4-0x000000001C320000-0x000000001C3C6000-memory.dmp

                                                          Filesize

                                                          664KB

                                                          Download

                                                        • memory/3700-2-0x000000001BDA0000-0x000000001C26E000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/3700-7-0x000000001C660000-0x000000001C6AC000-memory.dmp

                                                          Filesize

                                                          304KB

                                                          Download

                                                        • memory/3700-6-0x0000000001240000-0x0000000001248000-memory.dmp

                                                          Filesize

                                                          32KB

                                                          Download

                                                        • memory/3700-0-0x00007FFBE3DA0000-0x00007FFBE4741000-memory.dmp

                                                          Filesize

                                                          9.6MB

                                                          Download

                                                        • memory/3700-1-0x0000000001370000-0x0000000001380000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3700-5-0x000000001C470000-0x000000001C50C000-memory.dmp

                                                          Filesize

                                                          624KB

                                                          Download

                                                        • memory/3700-3-0x00007FFBE3DA0000-0x00007FFBE4741000-memory.dmp

                                                          Filesize

                                                          9.6MB

                                                          Download

                                                        • memory/3700-29-0x00007FFBE3DA0000-0x00007FFBE4741000-memory.dmp

                                                          Filesize

                                                          9.6MB

                                                          Download

                                                        • memory/4528-31-0x00000000009F0000-0x0000000000A00000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/4528-32-0x00007FFBE3DA0000-0x00007FFBE4741000-memory.dmp

                                                          Filesize

                                                          9.6MB

                                                          Download

                                                        • memory/4528-30-0x00007FFBE3DA0000-0x00007FFBE4741000-memory.dmp

                                                          Filesize

                                                          9.6MB

                                                          Download

                                                        • memory/4528-33-0x00000000009F0000-0x0000000000A00000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/4528-40-0x00007FFBE3DA0000-0x00007FFBE4741000-memory.dmp

                                                          Filesize

                                                          9.6MB

                                                          Download