Analysis
- max time kernel
1515s - max time network
1464s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
15/02/2024, 19:11
General
- Target Xmls/afterRiggersDiopter/abject/pictury.xml
- Size 9KB
- Sample240215-xvx86seb91
- SHA256 edda4569c9699ee026e862032059d7d9ec07da4365552ad772187dbdac9729e2
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Xmls\afterRiggersDiopter\abject\pictury.xml"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1492-6-0x00000286F0F40000-0x00000286F0F50000-memory.dmp
memory/1492-22-0x00000286F1040000-0x00000286F1050000-memory.dmp
memory/1492-38-0x00000286F93B0000-0x00000286F93B1000-memory.dmp
memory/1492-40-0x00000286F93E0000-0x00000286F93E1000-memory.dmp
memory/1492-41-0x00000286F93E0000-0x00000286F93E1000-memory.dmp
memory/1492-42-0x00000286F94F0000-0x00000286F94F1000-memory.dmp
memory/4464-0-0x00007FFBAC370000-0x00007FFBAC380000-memory.dmp
memory/4464-1-0x00007FFBEC2F0000-0x00007FFBEC4E5000-memory.dmp
memory/4464-2-0x00007FFBEC2F0000-0x00007FFBEC4E5000-memory.dmp
memory/4464-3-0x00007FFBE9D20000-0x00007FFBE9FE9000-memory.dmp
memory/4464-4-0x00007FFBAC370000-0x00007FFBAC380000-memory.dmp
memory/4464-5-0x00007FFBEC2F0000-0x00007FFBEC4E5000-memory.dmp