Analysis
- max time kernel
144s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240319-es - resource tags
- submitted
03/04/2024, 20:24
General
- Target x360ce.exe
- Size 14.7MB
- Sample240403-y6p8dacb42
- SHA256 74faf334cb0bdd3e9dfab8c323d4eb3b9b089bcaadc7dbd639d9aa93a4f6f829
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 34 IoCs
- Loads dropped DLL 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 28 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x360ce.exe"C:\Users\Admin\AppData\Local\Temp\x360ce.exe"1⤵
- Drops file in Windows directory
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3876 --field-trial-handle=2252,i,5414749771348078149,869093153057065571,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ViGEmClient.dll
audioendpoint.PNF
c_swdevice.PNF
cdrom.PNF
cpu.PNF
mshdc.PNF
msmouse.PNF
printqueue.PNF
usbport.PNF
volume.PNF
memory/2828-22-0x000001DB50F10000-0x000001DB50F20000-memory.dmp
memory/2828-8-0x000001DB53CB0000-0x000001DB53E3A000-memory.dmp
memory/2828-25-0x000001DB53C50000-0x000001DB53C9A000-memory.dmp
memory/2828-26-0x000001DB54EC0000-0x000001DB54EE2000-memory.dmp
memory/2828-27-0x000001DB53F50000-0x000001DB54052000-memory.dmp
memory/2828-28-0x000001DB53E90000-0x000001DB53ED6000-memory.dmp
memory/2828-29-0x000001DB51FA0000-0x000001DB51FA8000-memory.dmp
memory/2828-30-0x000001DB53E70000-0x000001DB53E90000-memory.dmp
memory/2828-31-0x000001DB50F10000-0x000001DB50F20000-memory.dmp
memory/2828-23-0x000001DB51F70000-0x000001DB51F8C000-memory.dmp
memory/2828-0-0x00007FFFC48B0000-0x00007FFFC5371000-memory.dmp
memory/2828-10-0x000001DB52140000-0x000001DB52160000-memory.dmp
memory/2828-9-0x000001DB50F10000-0x000001DB50F20000-memory.dmp
memory/2828-24-0x000001DB522B0000-0x000001DB522DC000-memory.dmp
memory/2828-6-0x000001DB51280000-0x000001DB512CA000-memory.dmp
memory/2828-4-0x000001DB51470000-0x000001DB5184A000-memory.dmp
memory/2828-2-0x000001DB50D30000-0x000001DB50EC2000-memory.dmp
memory/2828-3-0x000001DB50F10000-0x000001DB50F20000-memory.dmp
memory/2828-1-0x000001DB35940000-0x000001DB36802000-memory.dmp
memory/2828-226-0x00007FFFC48B0000-0x00007FFFC5371000-memory.dmp
memory/2828-227-0x000001DB50F10000-0x000001DB50F20000-memory.dmp
memory/2828-228-0x000001DB50F10000-0x000001DB50F20000-memory.dmp
memory/2828-229-0x000001DB50F10000-0x000001DB50F20000-memory.dmp
memory/2828-230-0x000001DB50F10000-0x000001DB50F20000-memory.dmp
memory/2828-231-0x000001DB50F10000-0x000001DB50F20000-memory.dmp
memory/2828-232-0x00007FFFC48B0000-0x00007FFFC5371000-memory.dmp