Overview
overview
10Static
static
3Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10WCLDll.dll
windows7-x64
1WCLDll.dll
windows10-2004-x64
1msvcp140.dll
windows7-x64
3msvcp140.dll
windows10-2004-x64
3ptMgr.dll
windows7-x64
1ptMgr.dll
windows10-2004-x64
3ptusredt.dll
windows7-x64
1ptusredt.dll
windows10-2004-x64
1vcruntime140.dll
windows7-x64
3vcruntime140.dll
windows10-2004-x64
3wbxtrace.dll
windows7-x64
1wbxtrace.dll
windows10-2004-x64
3x64/Templa...te.htm
windows7-x64
1x64/Templa...te.htm
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...re.dll
windows7-x64
1x64/plugin...re.dll
windows10-2004-x64
1x64/plugin...po.dll
windows7-x64
1x64/plugin...po.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1x64/plugin...ns.dll
windows7-x64
1x64/plugin...ns.dll
windows10-2004-x64
1Analysis
-
max time kernel
569s -
max time network
513s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 05:32
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
WCLDll.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
WCLDll.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
msvcp140.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
msvcp140.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
ptMgr.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
ptMgr.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
ptusredt.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
ptusredt.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
vcruntime140.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
vcruntime140.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
wbxtrace.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
wbxtrace.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
x64/Templates/TemplateCorreoCliente.htm
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
x64/Templates/TemplateCorreoCliente.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
x64/plugins/MahApps.Metro.IconPacks.BootstrapIcons.dll
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
x64/plugins/MahApps.Metro.IconPacks.BootstrapIcons.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
x64/plugins/MahApps.Metro.IconPacks.BoxIcons.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
x64/plugins/MahApps.Metro.IconPacks.BoxIcons.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
x64/plugins/MahApps.Metro.IconPacks.Codicons.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
x64/plugins/MahApps.Metro.IconPacks.Codicons.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
x64/plugins/MahApps.Metro.IconPacks.Coolicons.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
x64/plugins/MahApps.Metro.IconPacks.Coolicons.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
x64/plugins/MahApps.Metro.IconPacks.Core.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
x64/plugins/MahApps.Metro.IconPacks.Core.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
x64/plugins/MahApps.Metro.IconPacks.Entypo.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
x64/plugins/MahApps.Metro.IconPacks.Entypo.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
x64/plugins/MahApps.Metro.IconPacks.EvaIcons.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
x64/plugins/MahApps.Metro.IconPacks.EvaIcons.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
x64/plugins/MahApps.Metro.IconPacks.FeatherIcons.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
x64/plugins/MahApps.Metro.IconPacks.FeatherIcons.dll
Resource
win10v2004-20240226-en
General
-
Target
x64/plugins/MahApps.Metro.IconPacks.Coolicons.dll
-
Size
451KB
-
MD5
14f3f599e7a67c95d779820dba5a9fff
-
SHA1
b88ea6caa09ecf11d2e6dbae039ab0734a823345
-
SHA256
213956439f1d224be2f78ae9a345e2c02902750cd83a4a0439234afe801e75e5
-
SHA512
e295ab8f8d90208f6a41320868d73a225a12bedc15591f2a19103a659fb437016ebded0c8fd62c61db3a8dadaafb07565cb76a51fd4113acd20cd568e36807a2
-
SSDEEP
6144:Psu6HHHYtONor0Gw90Lx5FkbrawYhhGqlQz08aWFe/HD6TYm5oE3e3FsPgiu9g3z:P1774BfdWECoBmW
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 2496 svchost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\plugins\MahApps.Metro.IconPacks.Coolicons.dll,#11⤵PID:2328
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:2244
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496