Analysis
-
max time kernel
1745s -
max time network
1165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20-04-2024 09:09
General
-
Target
HorizonXbeta/redist/oalinst.exe
-
Size
790KB
-
MD5
694f54bd227916b89fc3eb1db53f0685
-
SHA1
21fdc367291bbef14dac27925cae698d3928eead
-
SHA256
b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
-
SHA512
55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
-
SSDEEP
12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
Score
6/10
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HorizonXbeta\redist\oalinst.exe"C:\Users\Admin\AppData\Local\Temp\HorizonXbeta\redist\oalinst.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2544-21-0x000001F989740000-0x000001F989750000-memory.dmpFilesize
64KB
-
memory/2544-37-0x000001F989840000-0x000001F989850000-memory.dmpFilesize
64KB
-
memory/2544-53-0x000001F991B40000-0x000001F991B41000-memory.dmpFilesize
4KB
-
memory/2544-55-0x000001F991B70000-0x000001F991B71000-memory.dmpFilesize
4KB
-
memory/2544-57-0x000001F991C80000-0x000001F991C81000-memory.dmpFilesize
4KB
-
memory/2544-56-0x000001F991B70000-0x000001F991B71000-memory.dmpFilesize
4KB