24b74a95082c1e7b13379049b6d0762a8a70aa5368d05b917f793708d53d939c

Analysis

max time kernel
0s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3725cf3f74f6b21781696233273b668a.exe
Size

1013KB
MD5

3725cf3f74f6b21781696233273b668a
SHA1

9cc591a6c28dad8dba46a676a82449368a838ecb
SHA256

24b74a95082c1e7b13379049b6d0762a8a70aa5368d05b917f793708d53d939c
SHA512

68f8d042a1e844853f4d9e681011325324491b1057f337de3666ef7b21c60b5c9424a2a2de7eac682a401d5950ef7487f902089181bb5bafeaed0f6a63a4cbb2
SSDEEP

24576:kUdHNU0BDDiAtmIKLoQRGGm9bDq5d9F6DZBA:kwHNU0BpK0QRkZ+5jMk

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GooglesTool\GoogleOrganic.exe	3725cf3f74f6b21781696233273b668a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3725cf3f74f6b21781696233273b668a.exe
"C:\Users\Admin\AppData\Local\Temp\3725cf3f74f6b21781696233273b668a.exe"
1⤵
- Drops file in Program Files directory
PID:2116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start http://www.fulltekparcaizle.com/?setdown=ok
  2⤵
  PID:5016
- C:\Users\Admin\AppData\Local\Temp\Alexa.exe
  "C:\Users\Admin\AppData\Local\Temp\Alexa.exe"
  2⤵
  PID:776
- C:\Program Files (x86)\GooglesTool\GoogleOrganic.exe
  "C:\Program Files (x86)\GooglesTool\GoogleOrganic.exe"
  2⤵
  PID:224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Public\AlexaNSISPlugin.776.dll,RunDLLPingServerStep1 Welcome alxi-10.0
1⤵
PID:1392

C:\Windows\SYSTEM32\rundll32.exe
rundll32.exe C:\Users\Public\AlexaNSISPlugin.776.dll,RunDLLPingServerStep1 Welcome alxi-10.0
1⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81a1d46f8,0x7ff81a1d4708,0x7ff81a1d4718
1⤵
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.fulltekparcaizle.com/?setdown=ok
1⤵
PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9488953896296556917,18336383475905954899,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4112 /prefetch:2
  2⤵
  PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GooglesTool\GoogleOrganic.exe

Filesize
382KB

MD5
d270a38777711770a98ceef207a54a23

SHA1
2218f887b15f58e95528a41ef19c2db20cfcaeb4

SHA256
9f039be5a7839de8a1d8e41296c68b0b6a4603bca2bc761b54eceb01ffc9f169

SHA512
5c79d4e795b66c3113f56a3afe325780207c555b28d586ec4c595603af73d4cb98c2ed39e74e40dbb2ff151ac49b8872414dc5020a732038fb0a8d313b73df01

Download Submit
C:\Program Files (x86)\GooglesTool\GoogleOrganic.exe

Filesize
1.1MB

MD5
17a3d383ceb8eb85107dd2241a9a805d

SHA1
af85770b9b44e3a20cd26619b27f22aa06a1de1d

SHA256
228ef351b96c9163fc117eb27dd22dd797792663d0603d2fdb0b5b1cdbc47de3

SHA512
6aa97066b042e73363338f658bfbecbc743e1bc6db155e8b56e9c07673ddba2e973fc10572e5c0ce1291eff9e7d0d8b5dc26eea44a88f8a928b9a311233c1a30

Download Submit
C:\Program Files (x86)\GooglesTool\GoogleOrganic.exe

Filesize
381KB

MD5
a36568fb5d83ad15578dcf6716af7468

SHA1
2e2126e7e59c45110d9fd085f1262c97aa4713e5

SHA256
d60aab71ccde0bcb6af3b6114ab5150cf8f512459393f256ad0af60b6245cd22

SHA512
981d7b27217fb6da2c5192863c719c97fefb4fba0ae76819039142cb495a098703d69b658cbc60b1c98bc2bfb428b92897a2aff278a68966654b953ecc81c0fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Alexa.exe

Filesize
95KB

MD5
2618ed3b96b73940fa38440e198f2dd4

SHA1
4fc32df5b740e321a7b351afb489fa7fd6a21b9c

SHA256
05245e1d4c2b240b73c81c4d8f0385c9073fc025d73314e477375f55fa035385

SHA512
20299e9c918dca5b6d125aba4b23f77c7da00b08c8e6f79ab83ff0da05cd3a42846d07b108505ab3aeae76974b568eebd7aa164accde94e96d4bf1a10c490eeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Alexa.exe

Filesize
534KB

MD5
687714e194114cbdfc342efbb6227bfa

SHA1
4f4f4c7c68a249ec743165d15d1ffa9ae7c62128

SHA256
e67b69cf3488c60f6a57d49696aedb2d2743c4a9165f8f306df9d65c2c4f7bbc

SHA512
9ce8e0b73c5c1c49e90fe8eaff0831729c6477d185726b88d568f0dfa82e667ea93dcd9111820e98e35029d69885c42b2c842a28f91b78489a96a00c5370a0a2

Download Submit
memory/224-35-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/224-185-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/224-211-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/776-130-0x00000000023F0000-0x000000000240B000-memory.dmp

Filesize
108KB

Download
memory/2116-37-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download