41caeb1dab6ab9da4571b88cd0a0a2b3a21ce305909358e538a04f988d4a139f

Analysis

max time kernel
450s
max time network
459s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 16:43

Target

hwid pack/monitor serial/restart.exe
Size

63KB
MD5

8242ce426ad462eff02edae1487a6949
SHA1

9a4f382d427e0de729053535aaa3310cac5f087b
SHA256

b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
SHA512

aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
SSDEEP

768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx

Score

5^/10

Drops file in System32 directory 6 IoCs

Processes:

WMIADAP.EXE

description	ioc	process
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE

Drops file in Windows directory 4 IoCs

Processes:

WMIADAP.EXE

description	ioc	process
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

restart64.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

restart64.exeAUDIODG.EXE

description pid process

Token: SeLoadDriverPrivilege 3696 restart64.exe
Token: SeLoadDriverPrivilege 3696 restart64.exe
Token: 33 1408 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 1408 AUDIODG.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

restart64.exe

pid process

3696 restart64.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

restart.exe

description pid process target process

PID 2320 wrote to memory of 3696 2320 restart.exe restart64.exe
PID 2320 wrote to memory of 3696 2320 restart.exe restart64.exe

description	pid	process
Token: SeLoadDriverPrivilege	3696	restart64.exe
Token: SeLoadDriverPrivilege	3696	restart64.exe
Token: 33	1408	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1408	AUDIODG.EXE

description	pid	process	target process
PID 2320 wrote to memory of 3696	2320	restart.exe	restart64.exe
PID 2320 wrote to memory of 3696	2320	restart.exe	restart64.exe

C:\Users\Admin\AppData\Local\Temp\hwid pack\monitor serial\restart.exe
"C:\Users\Admin\AppData\Local\Temp\hwid pack\monitor serial\restart.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4740

C:\Windows\System32\perfc009.dat
Filesize
132KB

MD5
eff169e315d4831710128954078829fe

SHA1
898d07e9938cefa58f4af9b0b900484f28b0919d

SHA256
135153cad80349636f1854b497ea23b30d4e5b4960963ce1bfa3ba6c61e9e1d8

SHA512
7d8ce5c85f8c4ac1bcf2509783d3e892c44199aac6a9cc36ee7e0781607ad8b04073b1da36ecc0b9f95a4941c2fe181ae80bddb9eed16c7c721eee446441de1d

Download Submit
C:\Windows\System32\perfh009.dat
Filesize
699KB

MD5
a89ae42f5a026c19299f9fa3278556cd

SHA1
ec0a61aa2b89c9f80c734006446f124530e0f66b

SHA256
94ddaf67c6973113ef2992feab11bd2147194541c8c8efc82f7b51e89fc08a25

SHA512
fad978dd060c6a507d8be487d8478f4f550c2e3fa440c8b3f90c19771f9e2b0d34ead3fad6f026ea233bbd5ec0f5274b7dc6bab4ea4d090322d4406edd3a836e

Download Submit
C:\Windows\System32\wbem\Performance\WmiApRpl.h
Filesize
3KB

MD5
b133a676d139032a27de3d9619e70091

SHA1
1248aa89938a13640252a79113930ede2f26f1fa

SHA256
ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15

SHA512
c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

Download Submit
C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Filesize
29KB

MD5
ffdeea82ba4a5a65585103dd2a922dfe

SHA1
094c3794503245cc7dfa9e222d3504f449a5400b

SHA256
c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390

SHA512
7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a

Download Submit