1fc473958611f369cd79f6d35d96c8bd7ff5724b9980106b3284c917da17d674

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe
Size

14.2MB
MD5

9e916f04c4d7e01bdd6de42cba2019d7
SHA1

20811d633036ba7f9522bb60e3ef359960b4324d
SHA256

1fc473958611f369cd79f6d35d96c8bd7ff5724b9980106b3284c917da17d674
SHA512

c7ea5127ccd7fac203d1e3ecf459322792af58016ec9ffafe0fdc2cdf901e4f8b295ed60eba8998c27f338acf551b05a9753ea496eb3fcf57a0635c344cac785
SSDEEP

393216:kgexuDFDVOz2sQhDSx3hP36Ll0lkrlQQVGxFWKXVD/:kgex0OisLxhySkrlrGxFx/

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3508	SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe
3508	SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe
3508	SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
1992	taskkill.exe
400	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	taskkill.exe
Token: SeDebugPrivilege	400	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1992	3508	SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe	90
PID 3508 wrote to memory of 1992	3508	SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe	90
PID 3508 wrote to memory of 1992	3508	SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe	90
PID 3508 wrote to memory of 400	3508	SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe	93
PID 3508 wrote to memory of 400	3508	SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe	93
PID 3508 wrote to memory of 400	3508	SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe	93

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Riskware.AdAnti.20287.26357.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im FLiNGTrainer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im iPDFUpdate.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl13E2.tmp\nsDui.dll

Filesize
1.3MB

MD5
874800803e12da10f7d028d1a2bf640f

SHA1
b86ee59ab1efb739df6397a635d21f8787a08034

SHA256
7c652efcfc27057fcf7a2feaa74b69ec839a01d2f74344ca93b92f0b9288419f

SHA512
45dbda2c6e3a5fbba8a7cd0788928c5863e726d57724031f18080defc103e6803e40fcbdb07285bbfe973656372a5e73a42e504ad611c59eccbd8ed7422a4d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl13E2.tmp\nsExec.dll

Filesize
6KB

MD5
2fd10d2f8ae885cc7e34ff21703aef6c

SHA1
7a1862a0240684a423c2d988557ab5b306af85e1

SHA256
e0959b690f25160d590cfd7e2467bb9ce7e9d959663e7e203f502dce5246507d

SHA512
fde884c9e988dd04a0e6b1e14b295e911b3d835ca92ed1a7a4c8bdc05326446092d17f75013a4ec9dc3e05cb351fd42b87d9ed96df70d0d5e4c9048f5fb5a546

Download Submit