Overview
overview
7Static
static
71792EL4.4?...or.exe
windows7-x64
71792EL4.4?...or.exe
windows10-2004-x64
71792EL4.4?...ne.dll
windows7-x64
71792EL4.4?...ne.dll
windows10-2004-x64
71792EL4.4?...ce.dll
windows7-x64
71792EL4.4?...ce.dll
windows10-2004-x64
71792EL4.4?/Update.exe
windows7-x64
11792EL4.4?/Update.exe
windows10-2004-x64
11792EL4.4?/sign.dll
windows7-x64
11792EL4.4?/sign.dll
windows10-2004-x64
11792EL4.4?...pi.dll
windows7-x64
31792EL4.4?...pi.dll
windows10-2004-x64
3Analysis
-
max time kernel
141s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:35
Behavioral task
behavioral1
Sample
1792EL4.4?/ElementsEditor.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1792EL4.4?/ElementsEditor.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
1792EL4.4?/ElementsEngine.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
1792EL4.4?/ElementsEngine.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
1792EL4.4?/ElementsInterface.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
1792EL4.4?/ElementsInterface.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
1792EL4.4?/Update.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
1792EL4.4?/Update.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
1792EL4.4?/sign.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
1792EL4.4?/sign.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
1792EL4.4?/zlibwapi.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
1792EL4.4?/zlibwapi.dll
Resource
win10v2004-20240508-en
General
-
Target
1792EL4.4?/Update.exe
-
Size
101KB
-
MD5
1c14f26db6988b324bfeb1347f57f805
-
SHA1
10495d45e832a7899ca0910c53225e095c8b22c6
-
SHA256
8e41a0d3e866a0ace0f8c48e60d9e78cd9788189f24449d825e8f8fb6ec8101b
-
SHA512
b12afbcbab2a4bd4572e55475461bd39d321ad8fda69d9452bcde61e2c37cca732fba409687e3744faf3b85be51eee9080f8f19ce8fb11b2865012b9ec2f859c
-
SSDEEP
1536:Osc3EPdwBnqcVTdnCnuZIHDgIV0VNUIpWw/eSOdLh:DcgMqcVe9HMIqVBpPeSu
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Update.exedescription pid process Token: SeDebugPrivilege 2428 Update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1792EL4.4_\Update.exe"C:\Users\Admin\AppData\Local\Temp\1792EL4.4_\Update.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2428-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmpFilesize
4KB
-
memory/2428-1-0x0000000000D20000-0x0000000000D40000-memory.dmpFilesize
128KB
-
memory/2428-2-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/2428-3-0x0000000005E10000-0x00000000063B4000-memory.dmpFilesize
5.6MB
-
memory/2428-4-0x0000000005860000-0x00000000058F2000-memory.dmpFilesize
584KB
-
memory/2428-5-0x0000000005770000-0x000000000577A000-memory.dmpFilesize
40KB
-
memory/2428-7-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB