371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb

Analysis

max time kernel
136s
max time network
150s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
07/04/2024, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
Size 1.8MB
Sample240407-31qdeaaf39
SHA256 371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb
MD5 e1ea9325be242777d4d5ca9864564c82
SHA1 bcac37592a033a0066894d7e202ca2b01f4b8d0d
SHA512 1aa08a9eab09b4615b584a33574b780374ad6f56cafddef2548623f3eaa53ead79ab6a9e6ac428cb364760557a7dac67b17b53ed7e9efb386ce207b6f9952268
SSDEEP 49152:RM9QPdxwfE7WlFwKAfzuTiDFUFkwLNiXicJFFRGNzj3:R1PdVQFwKZCFgh7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
468	Process not Found
2796	alg.exe
1732	aspnet_state.exe
2880	mscorsvw.exe
2072	mscorsvw.exe
1764	mscorsvw.exe
944	mscorsvw.exe
1652	dllhost.exe
2996	ehRecvr.exe
1220	ehsched.exe

Loads dropped DLL 5 IoCs

pid	Process
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File opened for modification	C:\Windows\System32\alg.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4589a396cea407a.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\psmachine_64.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_ca.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_fa.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_pt-BR.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_zh-TW.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdate.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\GoogleCrashHandler64.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_bg.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_es-419.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_sl.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_th.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\GoogleUpdateCore.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_et.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_fi.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_id.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_ru.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_ta.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_tr.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\GoogleUpdateComRegisterShell64.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_hr.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_hu.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_kn.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_sw.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUT33ED.tmp	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\psmachine.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_fr.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_sv.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_cs.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\GoogleUpdate.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_iw.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_ja.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_vi.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\GoogleUpdateSetup.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_de.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_ko.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_pt-PT.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_sk.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_ml.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_ms.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_uk.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_ur.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\GoogleUpdateSetup.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_sr.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_da.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_en.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_fil.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_it.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_lv.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_es.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_is.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_no.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_pl.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_nl.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\psuser.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\psuser_64.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_bn.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_en-GB.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_mr.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\GoogleUpdateBroker.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_hi.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_lt.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_ro.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Program Files (x86)\Google\Temp\GUM33EC.tmp\goopdateres_te.dll	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{380A56E1-34C5-4D88-9023-AFFBC0899621}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{380A56E1-34C5-4D88-9023-AFFBC0899621}.crmlog	dllhost.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	688	371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
Token: SeShutdownPrivilege	1764	mscorsvw.exe
Token: SeShutdownPrivilege	944	mscorsvw.exe
Token: 33	2632	EhTray.exe
Token: SeIncBasePriorityPrivilege	2632	EhTray.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe
"C:\Users\Admin\AppData\Local\Temp\371ee78b2ea80872bdc1b35058a445c5e7b0b0ffc4000b13d9278ae567d654fb.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2796

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:1732

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2880

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  PID:2236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:2924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 248 -NGENProcess 1ec -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:2948

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1652

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:1220

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3016

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
PID:1796

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
PID:1564

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
PID:2776

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
PID:976

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OSE.EXE

Path C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 706KB
SHA256 aea1264930279d9bbfa156e3633b5dd2d9012458e0a409e5cda323da2f0aa95f
MD5 d2b9e1b2f1cccf065e9c37b8537204a4
SHA1 bc735a2901308eb33bef38320c43ce341e074570
SHA512 513eb412bbf973b4593032ad709271cf11b819ce40e5cac0ba42ced083cd8a647a602bb86bfb3e979b11526532649121f2e50931e25b667e28f9b35306e66d27
SSDEEP 12288:Tc2rokFXviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TcKoMr/TwSfVcYG3K/cJHlnFR+IGNe8c
MD5 SHA1 SHA512 SSDEEP

Submit Download

GROOVE.EXE

Path C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
Size 30.1MB
SHA256 ecd067da65d5e4fb5e0ea6ea1027337608c0a5da5a779e5aa046a01842d8c939
MD5 5c444701fd5abb9d45262f192bfe6613
SHA1 0c28b3131ca672ce7ef556a56d9c33c7c4be0016
SHA512 506726cb4e38c71a626aeba4c69249ec2923a6ce89a484b79c9c927754dd6f5006076fc4b0fde87fe78db4a5d6afcdc8a398058a1ece750d1378d318cc923288
SSDEEP 393216:KCTn7ItpJjH22kopVu/vWrn2hIhF4HPrmdTF64JmiHRjJWoTBxf2u4nc2PJPGa0J:KEcR5kYVu/efhF4vm64Ljg2Kc2PB0zN
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 f5361abb8c32e8516257d5be69630a060a36a05e9a6261ee7d3a0d773f8ad280
MD5 52f0be6c1f392dd915509877fb0ae75a
SHA1 db603f74063979cd28e401364099e2483cbc570d
SHA512 87ac429cefb1f195e65012a62b1ea8ad970e778339c002c320d94d539ac5ec1bd064ba3c06d6affb62a84b6f79541b7bb501dc6e87016f06ce46df34f48e6b4d
SSDEEP 24576:aPsJcuiZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:awcuqLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSPPSVC.EXE

Path C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
Size 5.2MB
SHA256 0bdf2e8e25b1690657d5b5b8cf02512ebe9e4f58a936b37a997dbaa76e5c78d5
MD5 eb7625c85ea2a08748d18e8704eacd02
SHA1 50b07ab66d77761dfa39681a6a99bcc803c95545
SHA512 49b8b2b7ab72d1a66a92ed031fb515cea893e184d54beed6941e5bafab4bbcb94e82a1cea8901a4fa8cabeb5b941cde80fc58f29274b42df964d915f1c9b6b0e
SSDEEP 49152:QqXC0FciXZbDsD49XpzK4Hy0kBkzCym7VRueZQ56fjdTfd2svYT7MiX2/IajNGvZ:w2JR95axyOked2swTgioGDT7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 8dddb1dd2ee1dc025cef6372ebeaf59accfe355551fe02fab057ab65dbe3e355
MD5 5e98d243322d55e1531063aa3dbc3da8
SHA1 85f65742348aa5084d96fd89600d80b26b0367a1
SHA512 b68f5a6448dba15ccf29ddca10491d8ff7d246fc982a31afd25ec91e605c89590d14831fd5f31302a29510bc6a9e0cb5e192ff881e3b8c3022d123b65914f926
SSDEEP 49152:7a/3xXBSZ4K5MJ1LvTMxbYsYBYSgxu9+fw4T4LNiXicJFFRGNzj3:LZ4K5MJabYsYNR7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscorsvw.exe

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
Size 648KB
SHA256 83738f465d7970afa226e58139ee512baff56cfa8c7238daeeaa70a391655832
MD5 a1b9a363eab46916cfff8ccadd2a0968
SHA1 8d41402f48086e5388bcbd9e00ee56b99165d9e9
SHA512 745e56c36aa986e833dda97bd67cd30c35f28a2d1b0ce2ca6c07c450da0129bd6f5f15f6e3cd8bb2977ab4bd09b0f63851684881aece45f8e0100be5712e4ec6
SSDEEP 12288:dyz2DWUCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kz2DWh/TwSfVcYG3K/cJHlnFR+IGNe8c
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngen_service.log

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
Size 872KB
SHA256 88b4963594d1ffbdafa8f66603985c0a4aa57f3def25f9c7551f852c0f0cada6
MD5 97880502754ce32d4cd533170d6488c5
SHA1 01c509aff634576904452280a65ad02a5d714d42
SHA512 7d4ce97b7bbfe4b271e8a5eed1522888e8eca1db851aee517d8310dee5c94aa9c693ad8e95c02ca32ae0c03c4b395a9ad47fe9519deb635dcc17265f0e4b18c4
SSDEEP 3072:BJlin7NO9ihISrXd+VDIIlLoHxGKDDLkHKaFF4j1kDy8ySiaL/FCXkO+Mi5FOtai:1Gen2PgxWl
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscorsvw.exe

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Size 678KB
SHA256 4509e43db218cf8e051237ef196f319d1849056d4ca8ad3515d325cb1d9db7d8
MD5 2ec1948241794ca2416d7f5dc36a9924
SHA1 03f071e79ba417d78a154a2d04ac26b68e83b3a2
SHA512 189cf828e9e1217563163c83d1b48b8d82a1660317e048659bbf2bc05b6991b804745c4e101e42cf10f37be2168932dd5e6d08a6d5a3febc1c4a899a008593e3
SSDEEP 12288:wuU58XMXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2wMj/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscorsvw.exe

Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
Size 625KB
SHA256 2402c76040af6ef431e810d96d90699c1a2c34976d271071da5dd5934b5d3bf3
MD5 07c616e92651eb64869e07a0fcf8c490
SHA1 063b2ce98748d88e74880c1c212ca7db8fb47f5b
SHA512 4d6cb498f86a93943c2e006c93dd335e47a3f0a85e42249627c13373f25ce940cc4014015b677446f878675548ef65a874c3af1de75bb3e5c0deaa82f4fc2ee5
SSDEEP 12288:0BNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngen_service.log

Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
Size 1003KB
SHA256 86f14d2b2317bfe82e4aec050b756e12594e72bace1a456c1d9e7413cd549e24
MD5 4fbd677834458e17af9c8403c7cdda35
SHA1 f68241e91cc6c3f8afc184f54cf3dd5023f1c248
SHA512 99ae43399c9660d3faebb9c860061db4f985d314de67f6e647bcd6db97ee4203b5391da77193acfc49558443915f0e7075577ec815edaf2978026cd5413cf568
SSDEEP 3072:GRMah2vsXHPXVstx03rOROkxkZV4CDZLXvqX+RX/VaW0wjxl/Kl4R5jozK2S9q/e:+lHzwky6TZ2nQ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscorsvw.exe

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
Size 656KB
SHA256 60db79aaa035a25dbd8ef093c979df6457f633306ba240841688c51fb577c53e
MD5 9a45f4dbb62dd32797a502a8ccae8146
SHA1 66b4ea7f4bcbc920d6e8fa41e57be3ed5dc02df3
SHA512 6a26e16c3fb29de27869740a58c48113ea40a473ddb54d9fb881e2b33bdc9d81beebfbf230d4e6fb99470a9fe03eee2d55251b824b73cd835bce97c5d6efd86f
SSDEEP 12288:CnVvGOEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CnVlO/TwSfVcYG3K/cJHlnFR+IGNe8jg
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 bf3e9c7bc985bcd2e549171db6de68ac76214b71d5cc82d2e7065e502dad5b63
MD5 01f89b961d17b9de20b0e4ba8c5855c3
SHA1 bcc9c5d6cf8663614f32efd8be011ce56528e35f
SHA512 2b3f2ee790a31346abc55e7b7004dd7702579e19dafea85845813161f0c6dfed1a0029bd9fd4836f7524a28994699f8744161283aa04e8347696853e7aa3738c
SSDEEP 24576:Dlv3yIUPE1Bubmq3nT6j3q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DlfyIUPE1BuB3uj6LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

aspnet_state.exe

Path \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
Size 603KB
SHA256 3525577a876d3cbd67b38c4a31871ca7c44dcd5823147fc4acc17c7fd350e05e
MD5 2e2ea2944aa9cdac138229e01dfb6261
SHA1 302541e36b3f2185a549ecb81cdfc87ae292fe12
SHA512 41a6ca361b072bce6f8b0a20692068f8c8ed8f7c80006d308b6bbe6e7db8dcca5d8da6d4f042bdef024b518f1c5ce1bf64c1c382e4c2470bc40e9cab070a430c
SSDEEP 12288:DRg4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DKK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path \Windows\System32\alg.exe
Size 644KB
SHA256 0e2e9c7e8b610d2fc14621d5c88103e7f79454f58df625046191a76051b0a827
MD5 a947baab2bbad16a583c24fe78e5933b
SHA1 0c37f1eada9879c10f02b89b1f6bc927a3c65acb
SHA512 da2ce6a14aac765622c27a3925226baa0fe628a4e09216d7e01a570c19d4ae98afd01a03d7436079b84e2bcada9a40b6e77d20e9a07af56191d0f62752d02752
SSDEEP 12288:bLWhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bLWN/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe

Path \Windows\System32\dllhost.exe
Size 577KB
SHA256 fdc2a7121bd5a365a3f41b91d5d3989fef1df9a9080b165700085c07f4dd5ce1
MD5 8164e22513082dfeb2ecafad57972341
SHA1 d846e91a8415b6f6ba96fe94cc126219795d20a2
SHA512 4e7dce70df0d0f90cbe38a5e0ce37486171db1153868cba26c9038d2605179cad8bc41dc680626498427942b4b6619c10393a8febb77d039c4ff52b707fd5e98
SSDEEP 12288:1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ehrecvr.exe

Path \Windows\ehome\ehrecvr.exe
Size 1.2MB
SHA256 3c2ebbce088a4e1a0e43cc9f5a977c35e054adf6ca077c5877f16abc012d8f22
MD5 96b78cf73a4e40f5eb5be4ae219c74c4
SHA1 5ff58f4c3fc7b46c6e5ae52a82985d72e90e5502
SHA512 b4e1f0a8dd2ad5621ec67dcfa077621cf3ef8f6613af760e89c801095c224922a0ea976bf7d6c8dd4c36ff18be7104d3ef8346bca6694c97dcbd777bde638f88
SSDEEP 24576:MGne3OZEIOLMCldIgbK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:S+ZizdIgbKLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ehsched.exe

Path \Windows\ehome\ehsched.exe
Size 691KB
SHA256 a04b9b1da719c43b368e85324e5ede3f2b7327474bca69eaf18863cc283a6062
MD5 a4873735557db9176c9efdb1ec85c789
SHA1 1c172786176403ffbaa7c95835fded736ee26e16
SHA512 ed617abe22e666e9506b6a3cd174c9cb899013202a0629f342405598857fa9d49687112e4566a8c1dc578320fd5700fdc2288f7196e735f80ccf124a4abd808a
SSDEEP 12288:uwXAwhYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JQwhq/TwSfVcYG3K/cJHlnFR+IGNe8jg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/688-270-0x0000000000400000-0x00000000005CD000-memory.dmp

Download

memory/688-1-0x0000000000400000-0x00000000005CD000-memory.dmp

Download

memory/688-6-0x0000000000240000-0x00000000002A6000-memory.dmp

Download

memory/688-0-0x0000000000240000-0x00000000002A6000-memory.dmp

Download

memory/944-275-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/944-140-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/976-312-0x000000002E000000-0x000000002E0B5000-memory.dmp

Download

memory/1220-175-0x0000000140000000-0x00000001400B2000-memory.dmp

Download

memory/1220-174-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1220-337-0x0000000140000000-0x00000001400B2000-memory.dmp

Download

memory/1220-182-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1564-288-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/1564-300-0x000000002E000000-0x000000002FE1E000-memory.dmp

Download

memory/1652-147-0x0000000100000000-0x0000000100095000-memory.dmp

Download

memory/1652-290-0x0000000100000000-0x0000000100095000-memory.dmp

Download

memory/1652-154-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1652-148-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1732-169-0x0000000140000000-0x000000014009D000-memory.dmp

Download

memory/1732-93-0x0000000140000000-0x000000014009D000-memory.dmp

Download

memory/1764-125-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1764-124-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1764-190-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1764-130-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1796-467-0x000007FEF4AF0000-0x000007FEF548D000-memory.dmp

Download

memory/1796-460-0x0000000000A90000-0x0000000000B10000-memory.dmp

Download

memory/1796-397-0x0000000000A90000-0x0000000000B10000-memory.dmp

Download

memory/1796-387-0x000007FEF4AF0000-0x000007FEF548D000-memory.dmp

Download

memory/1796-289-0x000007FEF4AF0000-0x000007FEF548D000-memory.dmp

Download

memory/1796-286-0x0000000000A90000-0x0000000000B10000-memory.dmp

Download

memory/1796-285-0x000007FEF4AF0000-0x000007FEF548D000-memory.dmp

Download

memory/2072-111-0x0000000010000000-0x00000000100A7000-memory.dmp

Download

memory/2072-137-0x0000000010000000-0x00000000100A7000-memory.dmp

Download

memory/2236-341-0x0000000000230000-0x0000000000296000-memory.dmp

Download

memory/2236-447-0x0000000073180000-0x000000007386E000-memory.dmp

Download

memory/2236-335-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2604-324-0x0000000100000000-0x0000000100542000-memory.dmp

Download

memory/2604-355-0x00000000746F8000-0x000000007470D000-memory.dmp

Download

memory/2604-339-0x0000000100000000-0x0000000100542000-memory.dmp

Download

memory/2604-333-0x0000000000260000-0x00000000002C0000-memory.dmp

Download

memory/2776-302-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2776-303-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2776-313-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2776-314-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2796-49-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/2796-156-0x0000000100000000-0x00000001000A4000-memory.dmp

Download

memory/2796-48-0x0000000100000000-0x00000001000A4000-memory.dmp

Download

memory/2796-70-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/2880-96-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2880-97-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/2880-102-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/2880-122-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2924-465-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2924-468-0x0000000000AA0000-0x0000000000B06000-memory.dmp

Download

memory/2924-471-0x0000000073180000-0x000000007386E000-memory.dmp

Download

memory/2996-188-0x0000000001430000-0x0000000001431000-memory.dmp

Download

memory/2996-345-0x0000000001430000-0x0000000001431000-memory.dmp

Download

memory/2996-161-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/2996-168-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/2996-186-0x0000000001380000-0x0000000001390000-memory.dmp

Download

memory/2996-308-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/2996-187-0x0000000001390000-0x00000000013A0000-memory.dmp

Download

memory/3016-376-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3016-192-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3016-191-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3016-274-0x0000000000400000-0x0000000000460000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads