f54c4f803088e493a94c8f24d334d9849543def50bb0ec8cf47dfbbcc0754622

Analysis

max time kernel
141s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sysdiag-full-5.0.75.0-2023.11.20.1.exe
Size

22.7MB
MD5

eafc7638c1fc98d5f4b5d4545daa8d74
SHA1

aa4c02e712f4f0933f0df38290b43b01b1ae4ef9
SHA256

f54c4f803088e493a94c8f24d334d9849543def50bb0ec8cf47dfbbcc0754622
SHA512

fab097ad33006ebdfa8da2d895c433ddb0d5cd2807e3362959de0dd3b4ec681f6cb13015d3cf929b5c823d94b59d36b4354faf26ce2b95ee0adbade6a579394a
SSDEEP

393216:DRAv+30U9JPW02lcB0cBo2KDLedMlHH5YthB/JYi3w9/FaAB/s3vXY+u:DGv+3C020o2M+mHEz/JDQN7Bkgh

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 3 IoCs

pid	Process
1908	sysdiag-full-5.0.75.0-2023.11.20.1.exe
1908	sysdiag-full-5.0.75.0-2023.11.20.1.exe
1908	sysdiag-full-5.0.75.0-2023.11.20.1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	sysdiag-full-5.0.75.0-2023.11.20.1.exe
Token: SeLoadDriverPrivilege	1908	sysdiag-full-5.0.75.0-2023.11.20.1.exe
Token: SeDebugPrivilege	1908	sysdiag-full-5.0.75.0-2023.11.20.1.exe
Token: SeLoadDriverPrivilege	1908	sysdiag-full-5.0.75.0-2023.11.20.1.exe
Token: SeDebugPrivilege	1908	sysdiag-full-5.0.75.0-2023.11.20.1.exe
Token: SeLoadDriverPrivilege	1908	sysdiag-full-5.0.75.0-2023.11.20.1.exe

C:\Users\Admin\AppData\Local\Temp\sysdiag-full-5.0.75.0-2023.11.20.1.exe
"C:\Users\Admin\AppData\Local\Temp\sysdiag-full-5.0.75.0-2023.11.20.1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd41AE.tmp\DuiLib.dll

Filesize
20KB

MD5
5cf5ce3236ac4e5df4414871151d5074

SHA1
96783a64fa3b6b18726ce8e576060e60e3271b0d

SHA256
cccf2be7804fcf8f9390265df283848a9439dcd68192858093b3a5d3e2785805

SHA512
811bf1c9091cf446c1935f2eceaf1ac4ad71e194562c9cd8eaea318d434cb81a46b24326178d6d88a85248e4fdf6cfa8784b8c3e55c7cabc35f6f2d42115e103

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd41AE.tmp\System.dll

Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd41AE.tmp\inst.ui

Filesize
98KB

MD5
b2836e452d9a0baad9bcb9050ea7caad

SHA1
650e8bbf7d33e274417dd3e65a62623db06218ad

SHA256
ff9534c0f4daf2f1c40af94b164802591869f08f7899ef9e47c0d4ee77d5bd03

SHA512
ee9a30f5d9efa89d93e0d97cb87a651a770ced0007f329b29342b50a4ad88ccb8b59ba1b2ecc282ff2ef8495687f19779b481218b3709f1199ede49fb9ae6832

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd41AE.tmp\installer-helper.dll

Filesize
37KB

MD5
887f3b4fcd95b71a7bde4d84f6add469

SHA1
fc0d70865d079109d553905f0ad55795e614c1ec

SHA256
1b5937a5f632e1e22fbaa55bb594e67d908e7047a4764360ea45ebee6c7bb42a

SHA512
dee0540fb9d99da0fe57e956b0f4f33c6cd556b48e7fca6372cd55deb88586d0381075e2086c62c0dff385507c0e114c3484b5d9a5d257ec951f19873b9a69ad

Download Submit