Analysis
- max time kernel
1723s - max time network
1157s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
15/02/2024, 19:11
General
- Target Xmls/afterRiggersDiopter/abject/jujuistPuisneRadion/kelliesPreceptPrecept.xml
- Size 12KB
- Sample240215-xvx86seb91
- SHA256 f6e4e24eb60179ac3a7bde91226c53d2a4dea03aa993bd277179819decffc6f5
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Xmls\afterRiggersDiopter\abject\jujuistPuisneRadion\kelliesPreceptPrecept.xml"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4016-6-0x0000020A1E740000-0x0000020A1E750000-memory.dmp
memory/4016-22-0x0000020A1E840000-0x0000020A1E850000-memory.dmp
memory/4016-38-0x0000020A26B70000-0x0000020A26B71000-memory.dmp
memory/4016-40-0x0000020A26BA0000-0x0000020A26BA1000-memory.dmp
memory/4016-41-0x0000020A26BA0000-0x0000020A26BA1000-memory.dmp
memory/4016-42-0x0000020A26CB0000-0x0000020A26CB1000-memory.dmp
memory/4656-0-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp
memory/4656-1-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp
memory/4656-2-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp
memory/4656-3-0x00007FFE29560000-0x00007FFE29829000-memory.dmp
memory/4656-4-0x00007FFDEB9F0000-0x00007FFDEBA00000-memory.dmp
memory/4656-5-0x00007FFE2B970000-0x00007FFE2BB65000-memory.dmp