Analysis
-
max time kernel
155s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19/04/2024, 16:14
General
-
Target
c19f25ac997f6cc48b0e931a83e186592275c8388f1ff9ef0c90462fba604940.exe
-
Size
1.3MB
-
MD5
aa4263ef4d5ba9380e0ffdfed6617dc9
-
SHA1
0bf0fb785fd18a71210d0a53b572a41f5c0e2477
-
SHA256
c19f25ac997f6cc48b0e931a83e186592275c8388f1ff9ef0c90462fba604940
-
SHA512
c3425ef84dfa1ea4f6c74aad11158fd911c6db938e79809875c0e99b77f832e96c2f57487683e0bfe82694f79a0b249dea551ccad01b741f909ea8558ed88b9b
-
SSDEEP
12288:u09B+VjMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:u09B/SkQ/7Gb8NLEbeZ
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
-
Drops file in System32 directory 8 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c19f25ac997f6cc48b0e931a83e186592275c8388f1ff9ef0c90462fba604940.exe"C:\Users\Admin\AppData\Local\Temp\c19f25ac997f6cc48b0e931a83e186592275c8388f1ff9ef0c90462fba604940.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5aa21646f3cb425d2106cedd4abdbb479
SHA15c65ccd3e3ea012caa9f3086c935ef9d9bf155d2
SHA25665888a13cf167b67edf5192471a9dc05fd6720baea41db94a9497ef4d5d729a3
SHA512f6905a269fa6a6dd9345e0638006d9532aa6b36f5e5cbaf5eac17ce7a19a85e36eb76b96cf640dcc2255b62145ba7780fcb6ffb01c7d9f388bde04d9fb2f3e05
-
Filesize
1.4MB
MD5ee104981f5b2fb17c077d590eaa3121b
SHA11c5f82176658421fac469cc57c278d17024d617a
SHA2569551cfe6da60c30fac29ad3d02d4bbc381215ee5873e2e6a226d16ff30e24205
SHA512a191f2aa6dde5f07b88f2cfd8042930ec30f4a8fa34162af979e56c3b96f2b106b4d7c917e0c0580689bfcf5d7f0ef53cb9e8025713ea80bf524e5c6bcf5db81
-
Filesize
1.4MB
MD535ff07d085af1ca0acb39f9e53e75d44
SHA1892a041368a7c5251f2f11055adc7e87710c1d21
SHA2567095bf28552f46f1db07831d436a318ddda4008cb825b23d317932435bf46266
SHA512c4362100a287420d16795957cfc479806c0cd2c9670975ab4b16d188a8ddc37b6caa20d4bb870066285db5e98fbb03d7da67d2bef889ab901ebea3d324a306c5
-
Filesize
2.1MB
MD538f985e652e355b41cceb7e68eff0ebe
SHA1dd9bd60016365e845396c7783c900ca02e1070c5
SHA2564359b3661261c6fc43739ae285f529cb8811997ce32ebf5ee9db924fc055ff8e
SHA512f587a902840ab49f53eb7c178f675f864c50933e0aa39908ac5b9582022eb372a94d375fcddf9585bb21b3e9f5f4ed9a1a372bd2b8e2c82878ac7a38165a400c
-
Filesize
1.2MB
MD5eb7a7a340017fbc038dc44811b47cd05
SHA1b565a8ddfe2b22bc0d5e24c5c5ac14735b110c0a
SHA25621a0aac0ffeb359c9fa986680c640b3e47ebedae44304ebd964a64295832227e
SHA51292c44dda5eca8d634f387550e8f1c4d0709c488bfdabd0dedd48227a1dd4514939dcf01d7412eda0e192c03826989b1778cde3b4b92c7d25e7ee957222e09b87
-
Filesize
1.2MB
MD5fcacb4954e4164f7b00affcd517c9780
SHA160db2c0a2d7871f5e90f77c5c710500ef5805b0e
SHA256f25a7f7298e1694ed33018b9189efda861b1e429c8394d078822205f952f3214
SHA512fdbf4a41a7bc6a9835de54656ebce5de15a71e6881d360f2c6c974ddb47ee0f18d81b8693b8816e991a05758001a54b032f83e5e0a3564a20bf9492bfa50aee8
-
Filesize
1.2MB
MD55b2f5a6091f5b1ad270b52e49e7730ac
SHA186d1a683f134cf3e2ec974e9cc52a5192566d706
SHA2569cb019ff49934665f2a2d92810ee09f4f0a18baa52fcd627d9e7fc12663da201
SHA51218689985fd679f4554e2a51f6e454e0bbaebe899d7f1ccb77c2ac0df2b719aabb5e75ff469379379255f02a9c34222360cd14549b8584c4abfefd36203a69761
-
Filesize
1.3MB
MD559cacf804d83525c8d60783aca8e97dc
SHA1c51b575e3780e6519175a5269ddd641f8a079b26
SHA256d18855753404c260b5b5d52a210d5d1339e101182bbc6c1bffcbc6670fc8336a
SHA512ab370139e7b10d221f07fc07c4083011f9cea655cba241a4e231084a48695872ec5f07fc6f7a3340bd0973eb08f95d1a40cfa891b7ec314d8949cab2224451a7
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.3MB
-
Filesize
408KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB