69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704

Analysis

max time kernel
1s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
Size

1.6MB
MD5

ea4d996b472fabecc83c821342a6f2da
SHA1

3d6f8b3ea30f2da6392843b09c6a4039bda72040
SHA256

69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704
SHA512

fd44c2ad95e661fb4de273cc21a3102a8f1361f7377bd1bf6228476f3e41a3c52159d991cdedd517b139c35c102d2f8539db51b30b45c37230876824d854f40e
SSDEEP

12288:PZak9NyN+gGo3gnqYI2xsuz+dIoMfySCbne++ZgmCWJ3Mi1EesvxuAySjZF:99NyN+F0YfxzccaSL++aGJFayKZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
3376	alg.exe
4224	DiagnosticsHub.StandardCollector.Service.exe
332	fxssvc.exe
2320	elevation_service.exe
5032	elevation_service.exe
524	maintenanceservice.exe
4908	msdtc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
File opened for modification	C:\Windows\System32\msdtc.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
File opened for modification	C:\Windows\system32\msiexec.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
File opened for modification	C:\Windows\System32\alg.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c5cf46a37c1fafa7.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3924	69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
Token: SeAuditPrivilege	332	fxssvc.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4368

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3256

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2276

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:5160
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5728
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  PID:5768

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3632

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4200

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4432

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:1004

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4768

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:3580

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:1700

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
PID:1696

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:524

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5032

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2320

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4072

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3376

C:\Users\Admin\AppData\Local\Temp\69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe
"C:\Users\Admin\AppData\Local\Temp\69cf1f011c501ebd306ff4803641dfeb7504139081d8c6d3532749ad8590e704.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-38-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/332-39-0x0000000000EC0000-0x0000000000F20000-memory.dmp

Filesize
384KB

Download
memory/332-45-0x0000000000EC0000-0x0000000000F20000-memory.dmp

Filesize
384KB

Download
memory/332-48-0x0000000000EC0000-0x0000000000F20000-memory.dmp

Filesize
384KB

Download
memory/332-51-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/384-197-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/384-134-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/384-141-0x0000000000640000-0x00000000006A7000-memory.dmp

Filesize
412KB

Download
memory/524-83-0x0000000002270000-0x00000000022D0000-memory.dmp

Filesize
384KB

Download
memory/524-89-0x0000000140000000-0x000000014015D000-memory.dmp

Filesize
1.4MB

Download
memory/524-78-0x0000000140000000-0x000000014015D000-memory.dmp

Filesize
1.4MB

Download
memory/524-86-0x0000000002270000-0x00000000022D0000-memory.dmp

Filesize
384KB

Download
memory/524-76-0x0000000002270000-0x00000000022D0000-memory.dmp

Filesize
384KB

Download
memory/1004-254-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1004-194-0x0000000000660000-0x00000000006C0000-memory.dmp

Filesize
384KB

Download
memory/1004-188-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1696-109-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1696-116-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/1696-172-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1700-123-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/1700-186-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/1700-130-0x0000000000700000-0x0000000000760000-memory.dmp

Filesize
384KB

Download
memory/2276-276-0x0000000000C20000-0x0000000000C80000-memory.dmp

Filesize
384KB

Download
memory/2276-270-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/2320-52-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/2320-54-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2320-120-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2320-59-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/3256-263-0x0000000000550000-0x00000000005B0000-memory.dmp

Filesize
384KB

Download
memory/3256-507-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/3256-255-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/3376-20-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/3376-13-0x0000000140000000-0x000000014013D000-memory.dmp

Filesize
1.2MB

Download
memory/3376-12-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/3376-75-0x0000000140000000-0x000000014013D000-memory.dmp

Filesize
1.2MB

Download
memory/3564-212-0x0000000140000000-0x0000000140175000-memory.dmp

Filesize
1.5MB

Download
memory/3564-280-0x0000000140000000-0x0000000140175000-memory.dmp

Filesize
1.5MB

Download
memory/3564-220-0x0000000000790000-0x00000000007F0000-memory.dmp

Filesize
384KB

Download
memory/3580-146-0x0000000140000000-0x0000000140128000-memory.dmp

Filesize
1.2MB

Download
memory/3580-211-0x0000000140000000-0x0000000140128000-memory.dmp

Filesize
1.2MB

Download
memory/3580-154-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/3632-290-0x0000000000660000-0x00000000006C0000-memory.dmp

Filesize
384KB

Download
memory/3632-282-0x0000000140000000-0x0000000140159000-memory.dmp

Filesize
1.3MB

Download
memory/3924-3-0x0000000140000000-0x000000014019A000-memory.dmp

Filesize
1.6MB

Download
memory/3924-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Filesize
384KB

Download
memory/3924-63-0x0000000140000000-0x000000014019A000-memory.dmp

Filesize
1.6MB

Download
memory/3924-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Filesize
384KB

Download
memory/4200-244-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4200-495-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4200-251-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Filesize
384KB

Download
memory/4224-34-0x0000000000540000-0x00000000005A0000-memory.dmp

Filesize
384KB

Download
memory/4224-91-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/4224-26-0x0000000000540000-0x00000000005A0000-memory.dmp

Filesize
384KB

Download
memory/4224-27-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/4368-167-0x0000000000780000-0x00000000007E0000-memory.dmp

Filesize
384KB

Download
memory/4368-160-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4368-224-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4432-268-0x0000000140000000-0x0000000140195000-memory.dmp

Filesize
1.6MB

Download
memory/4432-199-0x0000000140000000-0x0000000140195000-memory.dmp

Filesize
1.6MB

Download
memory/4432-207-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/4768-181-0x0000000000630000-0x0000000000690000-memory.dmp

Filesize
384KB

Download
memory/4768-240-0x0000000140000000-0x0000000140129000-memory.dmp

Filesize
1.2MB

Download
memory/4768-174-0x0000000140000000-0x0000000140129000-memory.dmp

Filesize
1.2MB

Download
memory/4852-234-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Filesize
384KB

Download
memory/4852-242-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Filesize
384KB

Download
memory/4852-239-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4852-226-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4908-93-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Filesize
384KB

Download
memory/4908-100-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Filesize
384KB

Download
memory/4908-92-0x0000000140000000-0x000000014014C000-memory.dmp

Filesize
1.3MB

Download
memory/4908-158-0x0000000140000000-0x000000014014C000-memory.dmp

Filesize
1.3MB

Download
memory/5032-64-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/5032-133-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/5032-71-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/5032-66-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/5160-297-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5160-303-0x0000000000880000-0x00000000008E0000-memory.dmp

Filesize
384KB

Download
memory/5768-503-0x000001504EFF0000-0x000001504F000000-memory.dmp

Filesize
64KB

Download
memory/5768-502-0x000001504EFE0000-0x000001504EFF0000-memory.dmp

Filesize
64KB

Download