Analysis

  • max time kernel
    3s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2024, 01:30

General

  • Target

    3cc50b9e1b80f6939109edce1fb14af0f4e8302817b6d5b715137486320a5894.exe

  • Size

    1.6MB

  • MD5

    f85366a5fe7e4a4d34bec24a0e73d378

  • SHA1

    4b5ed756e3589d50bd59801a6bec91425f70e7c8

  • SHA256

    3cc50b9e1b80f6939109edce1fb14af0f4e8302817b6d5b715137486320a5894

  • SHA512

    9aec68324f10b1785e276ae187343eb6c833cffbe105a267d425b13080081897e6dfe79985bf8269d9d716d3023043027e8b57ba6bc497dd4613904386fa5b78

  • SSDEEP

    12288:Kj9B+VZGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Kj9B1t/sBlDqgZQd6XKtiMJYiPU

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cc50b9e1b80f6939109edce1fb14af0f4e8302817b6d5b715137486320a5894.exe
    "C:\Users\Admin\AppData\Local\Temp\3cc50b9e1b80f6939109edce1fb14af0f4e8302817b6d5b715137486320a5894.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:208
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:3948
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2760
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:928
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2988
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    PID:4864
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3472
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
        PID:4816
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
          PID:3856
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
            PID:4488
            • C:\Windows\system32\SearchFilterHost.exe
              "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
              2⤵
                PID:5488
              • C:\Windows\system32\SearchProtocolHost.exe
                "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                2⤵
                  PID:5464
              • C:\Windows\system32\wbem\WmiApSrv.exe
                C:\Windows\system32\wbem\WmiApSrv.exe
                1⤵
                  PID:536
                • C:\Windows\system32\wbengine.exe
                  "C:\Windows\system32\wbengine.exe"
                  1⤵
                    PID:1180
                  • C:\Windows\system32\vssvc.exe
                    C:\Windows\system32\vssvc.exe
                    1⤵
                      PID:3480
                    • C:\Windows\System32\vds.exe
                      C:\Windows\System32\vds.exe
                      1⤵
                        PID:2680
                      • C:\Windows\system32\AgentService.exe
                        C:\Windows\system32\AgentService.exe
                        1⤵
                          PID:2408
                        • C:\Windows\system32\TieringEngineService.exe
                          C:\Windows\system32\TieringEngineService.exe
                          1⤵
                            PID:3312
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                            1⤵
                              PID:884
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                                PID:3748
                              • C:\Windows\system32\spectrum.exe
                                C:\Windows\system32\spectrum.exe
                                1⤵
                                  PID:4800
                                • C:\Windows\System32\snmptrap.exe
                                  C:\Windows\System32\snmptrap.exe
                                  1⤵
                                    PID:2100
                                  • C:\Windows\system32\locator.exe
                                    C:\Windows\system32\locator.exe
                                    1⤵
                                      PID:4172
                                    • C:\Windows\SysWow64\perfhost.exe
                                      C:\Windows\SysWow64\perfhost.exe
                                      1⤵
                                        PID:5000
                                      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                        1⤵
                                          PID:2728
                                        • C:\Windows\system32\fxssvc.exe
                                          C:\Windows\system32\fxssvc.exe
                                          1⤵
                                            PID:4348
                                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                            1⤵
                                              PID:1592

                                            Network

                                            MITRE ATT&CK Matrix

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • memory/208-7-0x0000000002420000-0x0000000002487000-memory.dmp

                                              Filesize

                                              412KB

                                            • memory/208-6-0x0000000002420000-0x0000000002487000-memory.dmp

                                              Filesize

                                              412KB

                                            • memory/208-0-0x0000000000400000-0x0000000000595000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/208-1-0x0000000002420000-0x0000000002487000-memory.dmp

                                              Filesize

                                              412KB

                                            • memory/208-13-0x0000000000400000-0x0000000000595000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/536-439-0x0000000140000000-0x00000001401A6000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/536-447-0x00000000004C0000-0x0000000000520000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/928-68-0x0000000140000000-0x00000001401AB000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/928-51-0x0000000001A60000-0x0000000001AC0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/928-61-0x0000000001A60000-0x0000000001AC0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/928-50-0x0000000140000000-0x00000001401AB000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/928-57-0x0000000001A60000-0x0000000001AC0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/1180-434-0x0000000000BD0000-0x0000000000C30000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/1180-427-0x0000000140000000-0x0000000140216000-memory.dmp

                                              Filesize

                                              2.1MB

                                            • memory/1592-311-0x0000000140000000-0x0000000140189000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/1592-246-0x0000000140000000-0x0000000140189000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/1592-244-0x0000000000700000-0x0000000000760000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/1592-251-0x0000000000700000-0x0000000000760000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2100-330-0x0000000140000000-0x0000000140176000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/2100-398-0x0000000140000000-0x0000000140176000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/2100-339-0x0000000000790000-0x00000000007F0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2408-383-0x0000000140000000-0x00000001401C0000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/2408-394-0x0000000000BD0000-0x0000000000C30000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2408-396-0x0000000140000000-0x00000001401C0000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/2680-408-0x0000000000C40000-0x0000000000CA0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2680-399-0x0000000140000000-0x0000000140147000-memory.dmp

                                              Filesize

                                              1.3MB

                                            • memory/2680-545-0x0000000140000000-0x0000000140147000-memory.dmp

                                              Filesize

                                              1.3MB

                                            • memory/2728-297-0x0000000000BF0000-0x0000000000C50000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2728-289-0x0000000140000000-0x000000014018B000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/2728-351-0x0000000140000000-0x000000014018B000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/2760-65-0x0000000000420000-0x0000000000480000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2760-66-0x0000000140000000-0x00000001401B0000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/2760-239-0x0000000140000000-0x00000001401B0000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/2760-73-0x0000000000420000-0x0000000000480000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2988-29-0x0000000140000000-0x0000000140237000-memory.dmp

                                              Filesize

                                              2.2MB

                                            • memory/2988-34-0x0000000000440000-0x00000000004A0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/2988-235-0x0000000140000000-0x0000000140237000-memory.dmp

                                              Filesize

                                              2.2MB

                                            • memory/2988-27-0x0000000000440000-0x00000000004A0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/3312-437-0x0000000140000000-0x00000001401C2000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3312-379-0x00000000006B0000-0x0000000000710000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/3312-371-0x0000000140000000-0x00000001401C2000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3480-412-0x0000000140000000-0x00000001401FC000-memory.dmp

                                              Filesize

                                              2.0MB

                                            • memory/3480-421-0x0000000000830000-0x0000000000890000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/3748-425-0x0000000140000000-0x00000001401E3000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/3748-357-0x0000000140000000-0x00000001401E3000-memory.dmp

                                              Filesize

                                              1.9MB

                                            • memory/3748-367-0x0000000000510000-0x0000000000570000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/3856-325-0x0000000000770000-0x00000000007D0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/3856-382-0x0000000140000000-0x00000001401D7000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3856-317-0x0000000140000000-0x00000001401D7000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3948-236-0x0000000140000000-0x000000014022B000-memory.dmp

                                              Filesize

                                              2.2MB

                                            • memory/3948-46-0x00000000001A0000-0x0000000000200000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/3948-39-0x0000000140000000-0x000000014022B000-memory.dmp

                                              Filesize

                                              2.2MB

                                            • memory/3948-38-0x00000000001A0000-0x0000000000200000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4172-369-0x0000000140000000-0x0000000140175000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/4172-304-0x0000000140000000-0x0000000140175000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/4172-313-0x00000000007D0000-0x0000000000830000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4348-256-0x0000000000E90000-0x0000000000EF0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4348-271-0x0000000140000000-0x0000000140135000-memory.dmp

                                              Filesize

                                              1.2MB

                                            • memory/4348-274-0x0000000000E90000-0x0000000000EF0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4348-265-0x0000000000E90000-0x0000000000EF0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4348-255-0x0000000140000000-0x0000000140135000-memory.dmp

                                              Filesize

                                              1.2MB

                                            • memory/4488-453-0x0000000140000000-0x0000000140179000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/4488-460-0x0000000000790000-0x00000000007F0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4800-411-0x0000000140000000-0x0000000140169000-memory.dmp

                                              Filesize

                                              1.4MB

                                            • memory/4800-352-0x0000000000770000-0x00000000007D0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4800-343-0x0000000140000000-0x0000000140169000-memory.dmp

                                              Filesize

                                              1.4MB

                                            • memory/4816-338-0x0000000140000000-0x0000000140199000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/4816-281-0x0000000000C50000-0x0000000000CB0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4816-270-0x0000000140000000-0x0000000140199000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/4864-15-0x0000000140000000-0x000000014018A000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/4864-22-0x0000000000580000-0x00000000005E0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4864-16-0x0000000000580000-0x00000000005E0000-memory.dmp

                                              Filesize

                                              384KB

                                            • memory/4864-213-0x0000000140000000-0x000000014018A000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/5000-300-0x0000000000400000-0x0000000000577000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/5000-365-0x0000000000400000-0x0000000000577000-memory.dmp

                                              Filesize

                                              1.5MB

                                            • memory/5488-548-0x0000024427270000-0x0000024427271000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/5488-547-0x0000024427250000-0x0000024427260000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/5488-546-0x0000024427240000-0x0000024427250000-memory.dmp

                                              Filesize

                                              64KB