453e20ce15c16dbd858ed422f9962c2bde7cd9ca45837eecb9096c66731809d3

Analysis

max time kernel
74s
max time network
80s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
27/06/2024, 10:41

Target

rick.zip
Size

477B
MD5

108d4862f0461ac7398741f15b355b19
SHA1

cb34a88604cf37b686b9b2d0bf7eebec12b1ab86
SHA256

453e20ce15c16dbd858ed422f9962c2bde7cd9ca45837eecb9096c66731809d3
SHA512

b990b78c629c206ded2dec6e2e7a3e3524020773d87260480094944dc8dd470482ef79073bbfea77e882fb3e217447ee6de63f7b54862e48470df8434ad16c39

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	SearchIndexer.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	2276	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 5064	2276	SearchIndexer.exe	75
PID 2276 wrote to memory of 5064	2276	SearchIndexer.exe	75
PID 2276 wrote to memory of 2248	2276	SearchIndexer.exe	76
PID 2276 wrote to memory of 2248	2276	SearchIndexer.exe	76

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\rick.zip
1⤵
PID:4296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4012

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5064
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 684 688 696 8192 692
  2⤵
  PID:2248

memory/2276-0-0x00000241CB620000-0x00000241CB630000-memory.dmp

Filesize
64KB

Download
memory/2276-16-0x00000241CB7D0000-0x00000241CB7E0000-memory.dmp

Filesize
64KB

Download
memory/2276-32-0x00000241CFC80000-0x00000241CFC88000-memory.dmp

Filesize
32KB

Download