Overview
overview
7Static
static
3extracted_...er.exe
windows10-ltsc 2021-x64
7extracted_...er.exe
windows11-21h2-x64
7extracted_...47.dll
windows10-ltsc 2021-x64
1extracted_...47.dll
windows11-21h2-x64
1extracted_...eg.dll
windows10-ltsc 2021-x64
1extracted_...eg.dll
windows11-21h2-x64
1extracted_...GL.dll
windows10-ltsc 2021-x64
1extracted_...GL.dll
windows11-21h2-x64
1extracted_...v2.dll
windows10-ltsc 2021-x64
1extracted_...v2.dll
windows11-21h2-x64
7extracted_...af.ps1
windows10-ltsc 2021-x64
3extracted_...af.ps1
windows11-21h2-x64
3extracted_...uk.ps1
windows10-ltsc 2021-x64
3extracted_...uk.ps1
windows11-21h2-x64
3extracted_...te.exe
windows10-ltsc 2021-x64
3extracted_...te.exe
windows11-21h2-x64
3extracted_...er.dll
windows10-ltsc 2021-x64
1extracted_...er.dll
windows11-21h2-x64
1extracted_...-1.dll
windows10-ltsc 2021-x64
1extracted_...-1.dll
windows11-21h2-x64
1Analysis
- max time kernel
83s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20241007-en - resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system - submitted
03/11/2024, 17:24
Static task
static1
Behavioral task
behavioral1
Sample
extracted_files/SearchFilter.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral2
Sample
extracted_files/SearchFilter.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
extracted_files/d3dcompiler_47.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral4
Sample
extracted_files/d3dcompiler_47.dll
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
extracted_files/ffmpeg.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral6
Sample
extracted_files/ffmpeg.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
extracted_files/libEGL.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral8
Sample
extracted_files/libEGL.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
extracted_files/libGLESv2.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral10
Sample
extracted_files/libGLESv2.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
extracted_files/locales/af.ps1
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral12
Sample
extracted_files/locales/af.ps1
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
extracted_files/locales/uk.ps1
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral14
Sample
extracted_files/locales/uk.ps1
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
extracted_files/resources/elevate.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral16
Sample
extracted_files/resources/elevate.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
extracted_files/vk_swiftshader.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral18
Sample
extracted_files/vk_swiftshader.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
extracted_files/vulkan-1.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral20
Sample
extracted_files/vulkan-1.dll
Resource
win11-20241007-en
windows11-21h2-x64
General
- Target extracted_files/SearchFilter.exe
- Size 152.7MB
- Sample241103-vy523sslhm
- SHA256 f062c7884844da7535cb7b4e7e0a517856022fbd410eb62ecf661fded2c473bc
- MD5 f237706156df9761f419fe5729a7045b
- SHA1 4c391ebeff4cdfbc87ca83772a535d4386e5a5b2
- SHA512 1360104da17109b656e6c552ffc1f2098bb333ddcbb43ef193612ea4d0702e9d859891883edacfb5b1b7ede4ad6d87b3a3a6a6503449efaa78c650abecf0f1b2
- SSDEEP 1572864:FLBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:FypCmJctBjj2+Jv
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1556 SearchFilter.exe -
pid Process 1900 powershell.exe 1512 powershell.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5580 SearchFilter.exe 5580 SearchFilter.exe 1900 powershell.exe 1900 powershell.exe 1512 powershell.exe 1512 powershell.exe - Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeShutdownPrivilege 1556 SearchFilter.exe Token: SeCreatePagefilePrivilege 1556 SearchFilter.exe Token: SeDebugPrivilege 1900 powershell.exe Token: SeShutdownPrivilege 1556 SearchFilter.exe Token: SeCreatePagefilePrivilege 1556 SearchFilter.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeIncreaseQuotaPrivilege 1512 powershell.exe Token: SeSecurityPrivilege 1512 powershell.exe Token: SeTakeOwnershipPrivilege 1512 powershell.exe Token: SeLoadDriverPrivilege 1512 powershell.exe Token: SeSystemProfilePrivilege 1512 powershell.exe Token: SeSystemtimePrivilege 1512 powershell.exe Token: SeProfSingleProcessPrivilege 1512 powershell.exe Token: SeIncBasePriorityPrivilege 1512 powershell.exe Token: SeCreatePagefilePrivilege 1512 powershell.exe Token: SeBackupPrivilege 1512 powershell.exe Token: SeRestorePrivilege 1512 powershell.exe Token: SeShutdownPrivilege 1512 powershell.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeSystemEnvironmentPrivilege 1512 powershell.exe Token: SeRemoteShutdownPrivilege 1512 powershell.exe Token: SeUndockPrivilege 1512 powershell.exe Token: SeManageVolumePrivilege 1512 powershell.exe Token: 33 1512 powershell.exe Token: 34 1512 powershell.exe Token: 35 1512 powershell.exe Token: 36 1512 powershell.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1556 wrote to memory of 5504 1556 SearchFilter.exe 80 PID 1556 wrote to memory of 5504 1556 SearchFilter.exe 80 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 1556 wrote to memory of 668 1556 SearchFilter.exe 82 PID 5504 wrote to memory of 1584 5504 cmd.exe 83 PID 5504 wrote to memory of 1584 5504 cmd.exe 83 PID 1584 wrote to memory of 3384 1584 net.exe 84 PID 1584 wrote to memory of 3384 1584 net.exe 84 PID 1556 wrote to memory of 5580 1556 SearchFilter.exe 85 PID 1556 wrote to memory of 5580 1556 SearchFilter.exe 85 PID 1556 wrote to memory of 4508 1556 SearchFilter.exe 86 PID 1556 wrote to memory of 4508 1556 SearchFilter.exe 86 PID 4508 wrote to memory of 1900 4508 cmd.exe 88 PID 4508 wrote to memory of 1900 4508 cmd.exe 88 PID 1556 wrote to memory of 3152 1556 SearchFilter.exe 90 PID 1556 wrote to memory of 3152 1556 SearchFilter.exe 90 PID 3152 wrote to memory of 1512 3152 cmd.exe 92 PID 3152 wrote to memory of 1512 3152 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\extracted_files\SearchFilter.exe"C:\Users\Admin\AppData\Local\Temp\extracted_files\SearchFilter.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:3384
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\extracted_files\SearchFilter.exe"C:\Users\Admin\AppData\Local\Temp\extracted_files\SearchFilter.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TeamsPackage" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 --field-trial-handle=1836,i,10137327479552096759,5393396471904771657,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:668
-
-
C:\Users\Admin\AppData\Local\Temp\extracted_files\SearchFilter.exe"C:\Users\Admin\AppData\Local\Temp\extracted_files\SearchFilter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TeamsPackage" --mojo-platform-channel-handle=2032 --field-trial-handle=1836,i,10137327479552096759,5393396471904771657,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -Command "(Get-WmiObject Win32_OperatingSystem).OSArchitecture""2⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "(Get-WmiObject Win32_OperatingSystem).OSArchitecture"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).NumberOfLogicalProcessors""2⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).NumberOfLogicalProcessors"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
- MD5 88dc70c361a22feac57b031dd9c1f02f
- SHA1 a9b4732260c2a323750022a73480f229ce25d46d
- SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
- MD5 d8b9a260789a22d72263ef3bb119108c
- SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
- SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ub5nistl.ac2.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\d04a532f-f069-4f38-b83e-3cf874760f5a.tmp.node
- Size 113KB
- SHA256 5d7a1606ad1a2480e3d1d2d01b0a9dec0829369366550b0e95517e7bd7675b0e
- MD5 d69a6a0ba85131370ecb0062fce17abc
- SHA1 f1d9b1dc2be089ebf530dae82c510cd01678dc82
- SHA512 99aaecdc0e753be37880b1702da03e48d66eb90904768af01d474832c1a053230859b7e9e471e8d7c7ed26af00f8db63459644c71ca21a81a4a5f864aad65dea
- SSDEEP 3072:UzRcNWAhK1tVCnoNclm92oP3YR8EryUGEAU:scNWAhK1vLNclQ25lVGA
- MD5 SHA1 SHA512 SSDEEP