Analysis
-
max time kernel
300s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
-
submitted
27-12-2023 01:14
General
-
Target
x360ce.exe
-
Size
14.7MB
-
MD5
be80f3348b240bcee1aa96d33fe0e768
-
SHA1
40ea5de9a7a15f6e0d891cd1ba4bca8519bb85ed
-
SHA256
74faf334cb0bdd3e9dfab8c323d4eb3b9b089bcaadc7dbd639d9aa93a4f6f829
-
SHA512
dfb3b191152981f21180e93597c7b1891da6f10b811db2c8db9f45bbecc9feb54bc032bdd648c7ad1134e9b09e5e2b9705d5e21294e1ae328a4390350745536a
-
SSDEEP
196608:n+/7/fO/vBSVnf+viDyJBwhsCArf+viDyJBQhsCAaIF/f+viDyJBaF9hsCA6EJ0k:nX/vu0Bwhs8vu0BQhsvFOvu0BaF9hsR
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 4 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 28 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x360ce.exe"C:\Users\Admin\AppData\Local\Temp\x360ce.exe"1⤵
- Drops file in Windows directory
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5f6fd140537140509171e2771c38534b4
SHA17a851875992006a7d9d3a474ce887df7794141ed
SHA256299ed273d32805ffd4da3e78b7e73390ca68c2eb377481d76b57829c3bae6da1
SHA51245914e85e3473b7dec1710be5e0bbb5ec6abae08b060c06ab0018aa54c5ecde2bd3ce6fd96c6ae37916e846839656fc988cc22a81d05b51f689b920477ae035f
-
Filesize
5KB
MD5faae33656c78deb72ff9b3bdd673fa3a
SHA1302b1f074d5a50636fafb2232e7928a05b05a30a
SHA2569836057b14021082e33547621ebaa4c1e6ec7a314f9d6e3e683695843b2a3b12
SHA5125d5d17a3702255b8e0093734885d8adc44f52d5057f5566b30032551494aeb43ab149c98a686eac5f680f470f24c6bc7883343789584573add2cac01066ea7ce
-
Filesize
4KB
MD59928873d826d3c2b28fc34de6a8d258b
SHA1004ce000c9a45c754b4b8683d04bad69399ede12
SHA2567a0b2d514fc79377984e382dbb0069891895d6c6410625c4978ab3cfcd094ff3
SHA5124ab53c58c0a7db9ed96f8483012b2f7cdfb9647d7ff10eb5eade9c54bf8ffc4013e35fc141b6f84d2d02a06d476591f8dc6fb2f31f8dd54c8d944fd8228cdef0
-
Filesize
29KB
MD5a8781afcba77ccb180939fdbd5767168
SHA13cb4fe39072f12309910dbe91ce44d16163d64d5
SHA25602b50cbe797600959f43148991924d93407f04776e879bce7b979f30dd536ba9
SHA5128184e22bb4adfcb40d0e0108d2b97c834cba8ab1e60fee5fd23332348298a0b971bd1d15991d8d02a1bc1cc504b2d34729ed1b8fea2c6adb57e36c33ac9559e9
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
112KB
-
Filesize
176KB
-
Filesize
296KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
14.8MB
-
Filesize
296KB
-
Filesize
3.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
9.9MB