Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04-08-2024 13:29
Behavioral task
behavioral1
Sample
XV2SSEdit.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
XV2SSEdit.exe
Resource
win10v2004-20240802-en
General
-
Target
XV2SSEdit.exe
-
Size
417KB
-
MD5
9a44e26a185c804fe8e61b0b9690f6bc
-
SHA1
e9d58fa5912012034828df2e0959eddfd0532ab0
-
SHA256
d52a48caa0e3480fc26b6a6f216c0a7af0c3ee20a68b6b2420355f8a1d8f65cf
-
SHA512
c894d1b3131f64af671ba8a8b5bd37b55c6afe80e9c866caf7b74e46abd73f1db20d6aeb1946e14dbee10d60d125a8d488b9a196193f942945f07aa858afd462
-
SSDEEP
12288:c+fUpi4O/gL6nc17xnc1yrlR3GpRcxTmnkN5Dpv76H/ZovPM6wn:iO/FnkvDpeH/KvTwn
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
XV2SSEdit.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XV2SSEdit.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2940 chrome.exe 2940 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
XV2SSEdit.exepid process 824 XV2SSEdit.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe Token: SeShutdownPrivilege 2940 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
chrome.exepid process 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe 2940 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2940 wrote to memory of 2596 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2596 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2596 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 1628 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2976 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2976 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2976 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe PID 2940 wrote to memory of 2284 2940 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XV2SSEdit.exe"C:\Users\Admin\AppData\Local\Temp\XV2SSEdit.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:824
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6fa9758,0x7fef6fa9768,0x7fef6fa97782⤵PID:2596
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1196 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:22⤵PID:1628
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:82⤵PID:2976
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:82⤵PID:2284
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:12⤵PID:2760
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2400 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:12⤵PID:2300
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2844 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:22⤵PID:2196
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1500 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:12⤵PID:1704
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3668 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:82⤵PID:2236
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3716 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:12⤵PID:976
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2480 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:12⤵PID:2848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2452 --field-trial-handle=1388,i,14920470923372512357,8616622719382055624,131072 /prefetch:12⤵PID:2728
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
311KB
MD520d36a471d410f5493d26c5f49435c0c
SHA1c203aa80f59f18f14b26b759b9c01c8e041cb4d4
SHA256720cfd5f115199df5028819487d8a35ede080f5f2d5a83300259b692821805c7
SHA512bed6433e2799ca7846e72385bdaad6969194186f738437a3efc1af27cec45eebd54a2207647dad04d048f7efaf4a8bc125129fe12c2ca7f086875157dfbb7d12
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
363B
MD552ef7c28d44174e513666ae3c9a115c8
SHA1ab7675c49f46a1d177696cc4073ffcceb82c3ad2
SHA256db35b761024a9bc347ea230f84016eeb42465adc4c4097344add3f241c38bcf0
SHA512a71e59985b8057b2166be76867160435405d19d8d26aaa67c7f95d81ea32b73f675a94e9815c687666a555a1ae36e40cb4363b9cee0d051698e7c328e517233c
-
Filesize
4KB
MD57d78b533ce0b7d5a03e55e96980412f9
SHA1937811c908914afc8b62edbfb2440d651c61b7ae
SHA2569f76ee73af4c1a68d83e19d67d7bd8eeea1524a18e23e211383bae3f702fb76b
SHA51297195f96fb394808663a72968953fc25eb5b266feb7a1afe61dc04ad082ce21f745c97a56dc3e3dfbe38559e701042e669a6d6903e562acfbd2f6bce9ffce8e3
-
Filesize
5KB
MD5253a658e74ed8d7d3b21040e616182be
SHA1a7a49fb96f5a1b5322ea13b54a420d907e97f592
SHA2562966258ea3ae492b3e39041b1da98fc8cac6420c68e57fac7886154e13310114
SHA512cc6c40e9e69b3beeffc50c4472c6308cf0664564f1ba0e37382327cc3d946226963be1d22f26ca03316ea394de424c5c76d4b9bb3939e812cc353017bcaeed55
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
311KB
MD5a5e61e98551b71484c113c589b992ec4
SHA11e257a400d6ec79fdd6fb2ddb1624395480f3164
SHA25682719c42c5641a09c0c55bff17307d05909012f90bdf73c66539c02cd1aa2bef
SHA5129798d24548edf8b23a0d5a94c452d5fe85d490498c36a87b9502a9ca683394f026e4c0d8d212e3232614667224e885628f15da5c12f192e665d8cf83997f58c7
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e