Analysis
-
max time kernel
108s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
05-01-2024 00:02
General
-
Target
4241a9d1c5c43ec5db4c6fe23935db29.exe
-
Size
920KB
-
MD5
4241a9d1c5c43ec5db4c6fe23935db29
-
SHA1
9da6d0a308f3fb35e5b4addedf1682cc3c4db758
-
SHA256
e42b38f6ff18a062ec1311226207cb52c72055325bc8d38459a8ab08c5246991
-
SHA512
5160cbdbd2109f7efd4da0936e9077eb14f0399f505d14e15c12f67e9ff5404f381a309a48b644d69d1f033858d3663319a68210e032496da228c62b1b939d31
-
SSDEEP
24576:DeFDHYvmR3wIJS7kF6lDJqLGT4RSskAUFOJwYAbkybo6S:yFbR147kQlDJqDdUhYAgyboT
Malware Config
Signatures
-
Drops file in Drivers directory 8 IoCs
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 24 IoCs
-
Drops file in System32 directory 32 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4241a9d1c5c43ec5db4c6fe23935db29.exe"C:\Users\Admin\AppData\Local\Temp\4241a9d1c5c43ec5db4c6fe23935db29.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1472 "C:\Users\Admin\AppData\Local\Temp\4241a9d1c5c43ec5db4c6fe23935db29.exe"2⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1448 "C:\Windows\SysWOW64\svehost.exe"3⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1460 "C:\Windows\SysWOW64\svehost.exe"4⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1440 "C:\Windows\SysWOW64\svehost.exe"5⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1416 "C:\Windows\SysWOW64\svehost.exe"6⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1464 "C:\Windows\SysWOW64\svehost.exe"7⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1476 "C:\Windows\SysWOW64\svehost.exe"8⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1488 "C:\Windows\SysWOW64\svehost.exe"9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1468 "C:\Windows\SysWOW64\svehost.exe"10⤵
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1480 "C:\Windows\SysWOW64\svehost.exe"11⤵
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111B
MD5887ba08985c20a4c2cc5750efb94fc8c
SHA194eb1f4ab0412760bd2083531b4b06a3a32f6c01
SHA256f1e17aa3be94f82b156c4d1cccd6d65a88654d9e967df7b648445c0a24578706
SHA512713f68e53498540f0d886e9b894a2b464f5c7db9da5b7601af39bf3e64ce04d72ad00e93d9271cb60a1907f29f2490d836a5bbbd4f195bc8d3039f0310e2bd7d
-
Filesize
111B
MD5c666a7f6b6323f8e43abdab2eabb1fab
SHA1fb181b0d0a20b84369c65ed2910b341e0a70d3a5
SHA256023f84f78f447230413eb5d9a7ef8ff1f877163280363f78231da301538a8feb
SHA5129220461fc3136c6cfab96d507f22eb3f1c36db78fd69d83f935dcb7dd75f76c646fc2f739e6621bc7b989f065898bd5e55f0f1254abe9f2d7b2cbb51cf44a94e
-
Filesize
111B
MD5d5b59bac130bcc99864a9bd6639ef6a5
SHA138ba861519b123f1001a736b5a6341853f23acbe
SHA2563017976c8dee8096364f26ac9c3e4d62187a18c0493df9bfc71017c42297a199
SHA512444d914cc814b7e0e72204d10bff0477e2c4d4586cbf44ad5d80e57c5b1c7ed52fc2eff33993694d24ef7c479529c7093274c3a728cee6c8e42d259ddceae07d
-
Filesize
111B
MD5bda271294727f4746772b6ac1a867728
SHA11a9071e19f0ac2dc5d3c2a19439a0f563edd3b9e
SHA256441780e964f490b2636502f00684195f5a111bdbc6a8e31d2ae0fbcc99db5288
SHA5121d8487ee9e53399f9f005fad9fec3dfa2d65b5fe4e9ab370e3cfb7a5ca0ebf2c4472137c69eef4f2ec28d583a6e16da74ae61cd7428885356c745e0c3249dc4d
-
Filesize
111B
MD5fd5f2f78464523f79653dde2df8bb20e
SHA1bd355e55408abe0b64db3751ec5563f7753affe5
SHA256ab9e8178e70151b07e4618817f8a876bf2f74fcbeaea620c31b2386d6beafd4c
SHA512f68eff358c65058fe631d86028af6862dca14c299551f0a8c9ac9538bdefcd704ff79818e06ad84c56d010389ccf5465fb05f7c84180009193538a7d275fbd11
-
Filesize
111B
MD5f2dbcbfe40da8da0143cdbb79a67b2d1
SHA14826dfa491157ecfb5b8a4a5fd168a77155e6ec3
SHA2560e6a92066c7a43580265312fc0603cdd3b8abb2c6158bb3f9898f0eebb795cb4
SHA512be51368db11a4338349da96cbdbae4ccf99f65b155715701b97489c4e03fc9eebf21fcaeafb889a1c8de3f8ea6edbc8c502c995884b101330d231084f3a3e94e
-
Filesize
111B
MD54cb889dda0994814b6598ec33f62256d
SHA1d8089f940f5931445b276e8a09a16680f0b69e4c
SHA2562a0b888700d058cb537c405ca88d500ebc7841948909701589ad09d56ed58720
SHA512161bc54cdc7545f8aed70a92fc021d4a363b171a268f6b3509b42654be141099cd706f5a983b1c038389b7cc7b01db6638abff126bb668c38296f451afb32b85
-
Filesize
111B
MD5210622eec7cb03f268969303cde30083
SHA13c3c54cfbb8c057a8c33e1ee8bf8a99a65d1c19f
SHA2564130f9108b6337e464377d66353a31608a83e06ebdf19c88de3fb47ec73f6f7f
SHA51281490552471cbd96583c6ce187041d4356006ced74919446583e770d55fae26f997787fc2f4ef11f65c1c8f90a72fde1a069a2924e5a399259be82bcc30f2f48
-
Filesize
111B
MD54b2d8e96ee7b61662d13bcc691516949
SHA1f0c15fffd6b5f8a97f72fc1ce0ff0bcaf56c151d
SHA256b386127f42e0b2a0cafa790358dcbcc8527286ec4d6e8b7b9b45cab399e1a702
SHA5121611aa59e72fa0118c763513a8e54de3496c15fc2bf9133b3794e25b19e122a7a5353bd42dfa004120ae21470d93a8ba0d2a7ce74fcf203cd2f03dc05507d05b
-
Filesize
111B
MD52a3e988f7e70de7f74f33e7dea0d0426
SHA1aa86cc8f4424fba84543e00fd2caeebdb12b029b
SHA2562b00c42c2440e4dc248dfee12a4cc97f0d8c0c46f0197fb8d257ec845c493f60
SHA512c2f96fe2b5d04c95c7e21cc78e5c580986d5a5551e34f01242e9f18a8693f9feeaf3c7954cccf79a6d348f6959ad737b3b3b1ade05f8aa64b31f58234d0232ce
-
Filesize
111B
MD50f0ea86711cb25989d07dd2b5e585b80
SHA108c9610967f7d9738edeb5cd50fe210930a38bbe
SHA256c89ac97b1e97ba9f7ea8e0691526c27018fb5a49b8d94c0633aa06350d987bf4
SHA51286a421f03a379cc04202811ca7f360e4a92e1d9d7952718d807363f83da6e7546e099da8441bb5df809a7c9dec3f2955d1d255bb8ce2e2aa29cacd6d3840b1cf
-
Filesize
111B
MD5980719e39f7bdb32a9893b303b117687
SHA1445d78cf0ea8ce6c4550fba368f4f1ec0a2805ef
SHA2563578b74eb370efbb8286f6d1bdb3c77044c2f2bf67b96d775300ad6029911c94
SHA512c457258bd7fbe76d79d55ce3394b095f7ed25ac512c37a26aa2154afa625405d703048152d58bebe7d808cd8d744432c3305d3bc5811e66bb5cd2fa916eb3b15
-
Filesize
86KB
MD53eb0beb8e318646104362537570fc6bc
SHA13cb48ea9073fcca5835adad307e14ebf0cfe7279
SHA256ab3f8c80b85aae70f89c8e7919d7dd147c2bc3ec68769e0bdb05fcc4083e3643
SHA512db5fd16749641de6282d36af7b1921f908850ece3429ffe5ad33d990431bf4990f0314d28af082394af1f4d66516d9d89806a38e2801c34b4dd1ccb69bfafe47
-
Filesize
125KB
MD541ba2f484f612f8f2b7402ac59fdc183
SHA1e19fe64d42ec858b8180453b27186844f9149859
SHA25670da6f5256c09d9dcce84cfd2f3964f7dab176fd4e6b48ffdab4ef60624e7ddf
SHA5125ab934d0f408ff0023d14895c57a13847973a9f542f5130e95a28bbeb6cb42bcc49424fbb7a0efb383b1da3c7f7a3d3065608403bb0b364e7fe1ec592a24d198
-
Filesize
920KB
MD54241a9d1c5c43ec5db4c6fe23935db29
SHA19da6d0a308f3fb35e5b4addedf1682cc3c4db758
SHA256e42b38f6ff18a062ec1311226207cb52c72055325bc8d38459a8ab08c5246991
SHA5125160cbdbd2109f7efd4da0936e9077eb14f0399f505d14e15c12f67e9ff5404f381a309a48b644d69d1f033858d3663319a68210e032496da228c62b1b939d31
-
Filesize
234KB
MD5cb0afba4f0fb6ca2b2ea0d2c3e86b588
SHA12459367892e012314b451e05de1f1162448a05fa
SHA2561b0fe60175c88f7cd3f3765b2f0f3eb1530b2e5e5b51f89a83e0322de32bdcf7
SHA512a4e2d66af68dee67be5883c4770c1339b6be4847a993619389404af6a7ec9763361d9a14c632ca6704f63d84b05483f4bea2ec035b466fdaf03ce68c5cbca128
-
Filesize
226KB
MD5aeefd6f812b9e066ec6f5992f27f4d2b
SHA1b882774181461a3db8437a414eb662c81692dc39
SHA256752e534c87d086683ba0803510000e49894544e7bafaa9ee0686e4be4f589048
SHA512924d0e5da43a4e2f7d7c736b71dc818c42abd5ff9a8c554f7280aa4bd33ecb3276f91588348db65fb38e53b4bdd3bf794f03189f870dbd9976fe9621eb901f18
-
Filesize
92KB
MD5a0309cc3200ee696aee435927e5d15a3
SHA1b29540691abadce398956a6fd195684d23f2a213
SHA256ac37c11f51d39d5eba5dde8f9e16f624c5c26d7ce923f8448fc9252dc844e488
SHA5125722b634a159b172b7fab7db15ce54579b4064b93e9ae68e78f8a1ef71466d2b9ae6e55c48b91bf9f7074ad161516dd3f3f19fe9ed73cf8504d41e0940a958da
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
84KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
84KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
84KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB