372b81cb23efd1c29173c72b812793d0e2b60cd4befd8c6917a206830a4c5af3

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roflection.exe
Size

129.8MB
MD5

77e73e6ad584def493fda2130eef776e
SHA1

a41e44b19945cd8473aec091efb6fd2e177e582d
SHA256

d4a2c6052852ee4106cb895a9dfc6caedf3a889a371ce3478e8ff9272bfe358e
SHA512

bdecd5fe6dd372284ff62439bfb60f0de161d32ca9430e507466cd6ad9dad1993f50afee3b3e8d7ad886c53f42b20020db7ab652f8f582fd8e5f0fd6f80097db
SSDEEP

1572864:7mYWQRWtJ65M7a2iu4Rywh9hJyO9N+oJOTU8f/kmgZ2sI:K4M7a2H4Ryu+dNgI

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4028	Roflection.exe
4028	Roflection.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3984	Roflection.exe
3984	Roflection.exe
1672	Roflection.exe
1672	Roflection.exe
1672	Roflection.exe
1672	Roflection.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4168	WMIC.exe
Token: SeSecurityPrivilege	4168	WMIC.exe
Token: SeTakeOwnershipPrivilege	4168	WMIC.exe
Token: SeLoadDriverPrivilege	4168	WMIC.exe
Token: SeSystemProfilePrivilege	4168	WMIC.exe
Token: SeSystemtimePrivilege	4168	WMIC.exe
Token: SeProfSingleProcessPrivilege	4168	WMIC.exe
Token: SeIncBasePriorityPrivilege	4168	WMIC.exe
Token: SeCreatePagefilePrivilege	4168	WMIC.exe
Token: SeBackupPrivilege	4168	WMIC.exe
Token: SeRestorePrivilege	4168	WMIC.exe
Token: SeShutdownPrivilege	4168	WMIC.exe
Token: SeDebugPrivilege	4168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4168	WMIC.exe
Token: SeRemoteShutdownPrivilege	4168	WMIC.exe
Token: SeUndockPrivilege	4168	WMIC.exe
Token: SeManageVolumePrivilege	4168	WMIC.exe
Token: 33	4168	WMIC.exe
Token: 34	4168	WMIC.exe
Token: 35	4168	WMIC.exe
Token: 36	4168	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4168	WMIC.exe
Token: SeSecurityPrivilege	4168	WMIC.exe
Token: SeTakeOwnershipPrivilege	4168	WMIC.exe
Token: SeLoadDriverPrivilege	4168	WMIC.exe
Token: SeSystemProfilePrivilege	4168	WMIC.exe
Token: SeSystemtimePrivilege	4168	WMIC.exe
Token: SeProfSingleProcessPrivilege	4168	WMIC.exe
Token: SeIncBasePriorityPrivilege	4168	WMIC.exe
Token: SeCreatePagefilePrivilege	4168	WMIC.exe
Token: SeBackupPrivilege	4168	WMIC.exe
Token: SeRestorePrivilege	4168	WMIC.exe
Token: SeShutdownPrivilege	4168	WMIC.exe
Token: SeDebugPrivilege	4168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4168	WMIC.exe
Token: SeRemoteShutdownPrivilege	4168	WMIC.exe
Token: SeUndockPrivilege	4168	WMIC.exe
Token: SeManageVolumePrivilege	4168	WMIC.exe
Token: 33	4168	WMIC.exe
Token: 34	4168	WMIC.exe
Token: 35	4168	WMIC.exe
Token: 36	4168	WMIC.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4648	4028	Roflection.exe	89
PID 4028 wrote to memory of 4648	4028	Roflection.exe	89
PID 4648 wrote to memory of 4168	4648	cmd.exe	91
PID 4648 wrote to memory of 4168	4648	cmd.exe	91
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 744	4028	Roflection.exe	92
PID 4028 wrote to memory of 3984	4028	Roflection.exe	93
PID 4028 wrote to memory of 3984	4028	Roflection.exe	93
PID 4028 wrote to memory of 1672	4028	Roflection.exe	109
PID 4028 wrote to memory of 1672	4028	Roflection.exe	109

C:\Users\Admin\AppData\Local\Temp\Roflection.exe
"C:\Users\Admin\AppData\Local\Temp\Roflection.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- C:\Users\Admin\AppData\Local\Temp\Roflection.exe
  "C:\Users\Admin\AppData\Local\Temp\Roflection.exe" --type=gpu-process --field-trial-handle=1720,8434626864550867743,3702745241649984497,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  PID:744
- C:\Users\Admin\AppData\Local\Temp\Roflection.exe
  "C:\Users\Admin\AppData\Local\Temp\Roflection.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,8434626864550867743,3702745241649984497,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Users\Admin\AppData\Local\Temp\Roflection.exe
  "C:\Users\Admin\AppData\Local\Temp\Roflection.exe" --type=gpu-process --field-trial-handle=1720,8434626864550867743,3702745241649984497,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\042137b9-99fd-4c6e-8bf6-63de6ab2771c.tmp.node

Filesize
137KB

MD5
04bfbfec8db966420fe4c7b85ebb506a

SHA1
939bb742a354a92e1dcd3661a62d69e48030a335

SHA256
da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

SHA512
4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0960369-b493-4806-abda-14ea39775809.tmp.node

Filesize
1.8MB

MD5
3072b68e3c226aff39e6782d025f25a8

SHA1
cf559196d74fa490ac8ce192db222c9f5c5a006a

SHA256
7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01

SHA512
61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61

Download Submit
memory/744-12-0x00007FFAEB0A0000-0x00007FFAEB0A1000-memory.dmp

Filesize
4KB

Download
memory/744-13-0x00000298F9F90000-0x00000298FA02E000-memory.dmp

Filesize
632KB

Download
memory/744-14-0x00000298F9F90000-0x00000298FA02E000-memory.dmp

Filesize
632KB

Download
memory/744-16-0x00000298F9F90000-0x00000298FA02E000-memory.dmp

Filesize
632KB

Download
memory/744-19-0x00000298F9F90000-0x00000298FA02E000-memory.dmp

Filesize
632KB

Download