Analysis
- max time kernel
1520s - max time network
1481s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
15/02/2024, 19:11
General
- Target Xmls/afterRiggersDiopter/abject/encaumaNickery.xml
- Size 8KB
- Sample240215-xvx86seb91
- SHA256 be380ff217e8272c6aeaa3ae087c4fa7afda164f442a6965cfbcd306426bf722
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Xmls\afterRiggersDiopter\abject\encaumaNickery.xml"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/944-0-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp
memory/944-1-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/944-2-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/944-3-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/944-4-0x00007FFF66390000-0x00007FFF66659000-memory.dmp
memory/944-5-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp
memory/944-6-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/3716-7-0x000001E1BF540000-0x000001E1BF550000-memory.dmp
memory/3716-23-0x000001E1BF640000-0x000001E1BF650000-memory.dmp
memory/3716-39-0x000001E1C7950000-0x000001E1C7951000-memory.dmp
memory/3716-41-0x000001E1C7980000-0x000001E1C7981000-memory.dmp
memory/3716-42-0x000001E1C7980000-0x000001E1C7981000-memory.dmp
memory/3716-43-0x000001E1C7A90000-0x000001E1C7A91000-memory.dmp