Analysis

  • max time kernel
    125s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-08-2024 13:29

General

  • Target

    XV2SSEdit.exe

  • Size

    417KB

  • MD5

    9a44e26a185c804fe8e61b0b9690f6bc

  • SHA1

    e9d58fa5912012034828df2e0959eddfd0532ab0

  • SHA256

    d52a48caa0e3480fc26b6a6f216c0a7af0c3ee20a68b6b2420355f8a1d8f65cf

  • SHA512

    c894d1b3131f64af671ba8a8b5bd37b55c6afe80e9c866caf7b74e46abd73f1db20d6aeb1946e14dbee10d60d125a8d488b9a196193f942945f07aa858afd462

  • SSDEEP

    12288:c+fUpi4O/gL6nc17xnc1yrlR3GpRcxTmnkN5Dpv76H/ZovPM6wn:iO/FnkvDpeH/KvTwn

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XV2SSEdit.exe
    "C:\Users\Admin\AppData\Local\Temp\XV2SSEdit.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4908
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
    1⤵
      PID:1644
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1584

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1584-56-0x00000241E4A40000-0x00000241E4A41000-memory.dmp

      Filesize

      4KB

    • memory/1584-29-0x00000241DC840000-0x00000241DC850000-memory.dmp

      Filesize

      64KB

    • memory/1584-81-0x00000241E4C90000-0x00000241E4C91000-memory.dmp

      Filesize

      4KB

    • memory/1584-48-0x00000241E4E20000-0x00000241E4E21000-memory.dmp

      Filesize

      4KB

    • memory/1584-80-0x00000241E4B80000-0x00000241E4B81000-memory.dmp

      Filesize

      4KB

    • memory/1584-79-0x00000241E4B80000-0x00000241E4B81000-memory.dmp

      Filesize

      4KB

    • memory/1584-77-0x00000241E4B70000-0x00000241E4B71000-memory.dmp

      Filesize

      4KB

    • memory/1584-49-0x00000241E4E20000-0x00000241E4E21000-memory.dmp

      Filesize

      4KB

    • memory/1584-65-0x00000241E4970000-0x00000241E4971000-memory.dmp

      Filesize

      4KB

    • memory/1584-62-0x00000241E4A30000-0x00000241E4A31000-memory.dmp

      Filesize

      4KB

    • memory/1584-59-0x00000241E4A40000-0x00000241E4A41000-memory.dmp

      Filesize

      4KB

    • memory/1584-54-0x00000241E4E20000-0x00000241E4E21000-memory.dmp

      Filesize

      4KB

    • memory/1584-13-0x00000241DC740000-0x00000241DC750000-memory.dmp

      Filesize

      64KB

    • memory/1584-50-0x00000241E4E20000-0x00000241E4E21000-memory.dmp

      Filesize

      4KB

    • memory/1584-46-0x00000241E4E20000-0x00000241E4E21000-memory.dmp

      Filesize

      4KB

    • memory/1584-47-0x00000241E4E20000-0x00000241E4E21000-memory.dmp

      Filesize

      4KB

    • memory/1584-57-0x00000241E4A30000-0x00000241E4A31000-memory.dmp

      Filesize

      4KB

    • memory/1584-55-0x00000241E4E20000-0x00000241E4E21000-memory.dmp

      Filesize

      4KB

    • memory/1584-45-0x00000241E4DF0000-0x00000241E4DF1000-memory.dmp

      Filesize

      4KB

    • memory/1584-51-0x00000241E4E20000-0x00000241E4E21000-memory.dmp

      Filesize

      4KB

    • memory/1584-52-0x00000241E4E20000-0x00000241E4E21000-memory.dmp

      Filesize

      4KB

    • memory/1584-53-0x00000241E4E20000-0x00000241E4E21000-memory.dmp

      Filesize

      4KB

    • memory/4908-10-0x0000000075330000-0x0000000075AE0000-memory.dmp

      Filesize

      7.7MB

    • memory/4908-7-0x00000000056B0000-0x00000000056CC000-memory.dmp

      Filesize

      112KB

    • memory/4908-0-0x000000007533E000-0x000000007533F000-memory.dmp

      Filesize

      4KB

    • memory/4908-3-0x0000000005120000-0x00000000051B2000-memory.dmp

      Filesize

      584KB

    • memory/4908-12-0x0000000075330000-0x0000000075AE0000-memory.dmp

      Filesize

      7.7MB

    • memory/4908-1-0x0000000000640000-0x00000000006AE000-memory.dmp

      Filesize

      440KB

    • memory/4908-9-0x000000007533E000-0x000000007533F000-memory.dmp

      Filesize

      4KB

    • memory/4908-6-0x0000000075330000-0x0000000075AE0000-memory.dmp

      Filesize

      7.7MB

    • memory/4908-5-0x0000000075330000-0x0000000075AE0000-memory.dmp

      Filesize

      7.7MB

    • memory/4908-4-0x00000000050B0000-0x00000000050BA000-memory.dmp

      Filesize

      40KB

    • memory/4908-2-0x0000000005860000-0x0000000005E04000-memory.dmp

      Filesize

      5.6MB