ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb

Analysis

max time kernel
133s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
Size

13.7MB
MD5

dbe4208fb00202aee0a0f2647f9e9e3d
SHA1

fab05eb11f482e1c5e6932795ac54991cdafe6bd
SHA256

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb
SHA512

f95d4ea97563cd68ddec0640d302d38ef3c24f2d8b59433d40f6c99229d76f931fe9d48d3f26b849ecd34ee77bd69422bb9a50a8788d9836698d647d148a1bf5
SSDEEP

196608:GWb5EYwRqXPpkx+nWih7pPdlBpsMarXLg9wntXBs+7lG9tmZ+ejCKPRJ:vlCokxWFdVlMMar7g9wnTNlgs+HKPr

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

pid	process
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

Drops file in Windows directory 1 IoCs

Processes:

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

description ioc process

File created C:\Windows\Media\xminfo.wav ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Media\xminfo.wav	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

pid	process
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

description	pid	process
Token: SeDebugPrivilege	1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
Token: SeDebugPrivilege	1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
Token: SeDebugPrivilege	1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

pid	process
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
1672	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

C:\Users\Admin\AppData\Local\Temp\ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
"C:\Users\Admin\AppData\Local\Temp\ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ÌìÁúÐ¡ÃÛ\ÔËÐÐÎÄ¼þ\QYCJ.dll
Filesize
3.0MB

MD5
54da9cb20347baec926b6678f8efb3ab

SHA1
18ca10861aa561c56666270cca7fd44c73c28d72

SHA256
038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390

SHA512
e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b

Download Submit
C:\ÌìÁúÐ¡ÃÛ\ÔËÐÐÎÄ¼þ\SoftXLic.ini
Filesize
550B

MD5
05c965be66d3478346207a87bfff50a2

SHA1
263f7a1e6da52d52776899d0e4a7b62d0e8a4e41

SHA256
e965acb123ddf3e18dc8d17b138109e45b5a3e6cce8d369b7bd00445f575dd8a

SHA512
243d407cc3765bea255c079ae87c524157d57435f76ebdacd2e1871fce705dca5bf2a108a3d8a3b4ef7db7ee3c05c79aad4a948b02bf9d8a5bc7f3389cc379a6

Download Submit
memory/1672-28-0x0000000005B40000-0x000000000618C000-memory.dmp

Filesize
6.3MB

Download
memory/1672-27-0x00000000039E0000-0x00000000039E1000-memory.dmp

Filesize
4KB

Download
memory/1672-30-0x0000000005BB1000-0x0000000005E8C000-memory.dmp

Filesize
2.9MB

Download
memory/1672-31-0x0000000005B40000-0x000000000618C000-memory.dmp

Filesize
6.3MB

Download
memory/1672-41-0x0000000005BB1000-0x0000000005E8C000-memory.dmp

Filesize
2.9MB

Download
memory/1672-42-0x0000000005B40000-0x000000000618C000-memory.dmp

Filesize
6.3MB

Download