Analysis
- max time kernel
1526s - max time network
1477s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
15/02/2024, 19:11
General
- Target Xmls/afterRiggersDiopter/emeril.xml
- Size 7KB
- Sample240215-xvx86seb91
- SHA256 e9b9a8cbff9af2177f82f57528d4612a9a3cd7a3f7d8546f5df7083bf66b34b5
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Xmls\afterRiggersDiopter\emeril.xml"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
store.jfm
memory/412-0-0x00007FF86D4D0000-0x00007FF86D4E0000-memory.dmp
memory/412-1-0x00007FF8AD450000-0x00007FF8AD645000-memory.dmp
memory/412-2-0x00007FF8AD450000-0x00007FF8AD645000-memory.dmp
memory/412-3-0x00007FF8AB170000-0x00007FF8AB439000-memory.dmp
memory/412-4-0x00007FF86D4D0000-0x00007FF86D4E0000-memory.dmp
memory/412-5-0x00007FF8AD450000-0x00007FF8AD645000-memory.dmp
memory/1608-44-0x0000020DF1300000-0x0000020DF1301000-memory.dmp
memory/1608-48-0x0000020DF1300000-0x0000020DF1301000-memory.dmp
memory/1608-39-0x0000020DF1300000-0x0000020DF1301000-memory.dmp
memory/1608-40-0x0000020DF1300000-0x0000020DF1301000-memory.dmp
memory/1608-41-0x0000020DF1300000-0x0000020DF1301000-memory.dmp
memory/1608-42-0x0000020DF1300000-0x0000020DF1301000-memory.dmp
memory/1608-43-0x0000020DF1300000-0x0000020DF1301000-memory.dmp
memory/1608-22-0x0000020DE8D40000-0x0000020DE8D50000-memory.dmp
memory/1608-45-0x0000020DF1300000-0x0000020DF1301000-memory.dmp
memory/1608-46-0x0000020DF1300000-0x0000020DF1301000-memory.dmp
memory/1608-47-0x0000020DF1300000-0x0000020DF1301000-memory.dmp
memory/1608-38-0x0000020DF12E0000-0x0000020DF12E1000-memory.dmp
memory/1608-49-0x0000020DF0F30000-0x0000020DF0F31000-memory.dmp
memory/1608-50-0x0000020DF0F20000-0x0000020DF0F21000-memory.dmp
memory/1608-52-0x0000020DF0F30000-0x0000020DF0F31000-memory.dmp
memory/1608-55-0x0000020DF0F20000-0x0000020DF0F21000-memory.dmp
memory/1608-58-0x0000020DF0E60000-0x0000020DF0E61000-memory.dmp
memory/1608-6-0x0000020DE8C40000-0x0000020DE8C50000-memory.dmp
memory/1608-70-0x0000020DF1060000-0x0000020DF1061000-memory.dmp
memory/1608-72-0x0000020DF1070000-0x0000020DF1071000-memory.dmp
memory/1608-73-0x0000020DF1070000-0x0000020DF1071000-memory.dmp
memory/1608-74-0x0000020DF1180000-0x0000020DF1181000-memory.dmp