Overview
overview
7Static
static
71792EL4.4?...or.exe
windows7-x64
71792EL4.4?...or.exe
windows10-2004-x64
71792EL4.4?...ne.dll
windows7-x64
71792EL4.4?...ne.dll
windows10-2004-x64
71792EL4.4?...ce.dll
windows7-x64
71792EL4.4?...ce.dll
windows10-2004-x64
71792EL4.4?/Update.exe
windows7-x64
11792EL4.4?/Update.exe
windows10-2004-x64
11792EL4.4?/sign.dll
windows7-x64
11792EL4.4?/sign.dll
windows10-2004-x64
11792EL4.4?...pi.dll
windows7-x64
31792EL4.4?...pi.dll
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:35
Behavioral task
behavioral1
Sample
1792EL4.4?/ElementsEditor.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1792EL4.4?/ElementsEditor.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
1792EL4.4?/ElementsEngine.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
1792EL4.4?/ElementsEngine.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
1792EL4.4?/ElementsInterface.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
1792EL4.4?/ElementsInterface.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
1792EL4.4?/Update.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
1792EL4.4?/Update.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
1792EL4.4?/sign.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
1792EL4.4?/sign.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
1792EL4.4?/zlibwapi.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
1792EL4.4?/zlibwapi.dll
Resource
win10v2004-20240508-en
General
-
Target
1792EL4.4?/Update.exe
-
Size
101KB
-
MD5
1c14f26db6988b324bfeb1347f57f805
-
SHA1
10495d45e832a7899ca0910c53225e095c8b22c6
-
SHA256
8e41a0d3e866a0ace0f8c48e60d9e78cd9788189f24449d825e8f8fb6ec8101b
-
SHA512
b12afbcbab2a4bd4572e55475461bd39d321ad8fda69d9452bcde61e2c37cca732fba409687e3744faf3b85be51eee9080f8f19ce8fb11b2865012b9ec2f859c
-
SSDEEP
1536:Osc3EPdwBnqcVTdnCnuZIHDgIV0VNUIpWw/eSOdLh:DcgMqcVe9HMIqVBpPeSu
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Update.exedescription pid process Token: SeDebugPrivilege 3052 Update.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3052-0-0x000000007481E000-0x000000007481F000-memory.dmpFilesize
4KB
-
memory/3052-1-0x0000000001360000-0x0000000001380000-memory.dmpFilesize
128KB
-
memory/3052-2-0x0000000074810000-0x0000000074EFE000-memory.dmpFilesize
6.9MB
-
memory/3052-3-0x0000000074810000-0x0000000074EFE000-memory.dmpFilesize
6.9MB