Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-11-2020 20:02
Behavioral task
behavioral1
Sample
111112.jpg.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
111112.jpg.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
111112.jpg.dll
-
Size
2.9MB
-
MD5
008dbbd90f4850bd5100ec7f7a44a718
-
SHA1
f40f99bab58d681f265cf1b6622cc087264c422c
-
SHA256
aed677ba2f94ebf7b7b9b5df50f06f91764e0e040a546bc008bc808cd9b7fd81
-
SHA512
6c02754f06976fda1dd2f24f1cd01e5156a184b1e1f65eef8010ebfade031960ff0ca203bcf7acc2ee45d04490a62366c59385e2c908d5a18204a3c12887d1ca
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 7 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exeSystemSettings.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID SystemSettings.exe -
Modifies Control Panel 1 IoCs
Processes:
SystemSettings.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors SystemSettings.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
taskmgr.exepid process 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
SystemSettings.exetaskmgr.exedescription pid process Token: SeShutdownPrivilege 2188 SystemSettings.exe Token: SeCreatePagefilePrivilege 2188 SystemSettings.exe Token: SeShutdownPrivilege 2188 SystemSettings.exe Token: SeCreatePagefilePrivilege 2188 SystemSettings.exe Token: SeDebugPrivilege 3148 taskmgr.exe Token: SeSystemProfilePrivilege 3148 taskmgr.exe Token: SeCreateGlobalPrivilege 3148 taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
Processes:
SystemSettings.exetaskmgr.exepid process 2188 SystemSettings.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
Processes:
SystemSettings.exetaskmgr.exepid process 2188 SystemSettings.exe 2188 SystemSettings.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe 3148 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SystemSettings.exepid process 2188 SystemSettings.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3116 wrote to memory of 668 3116 rundll32.exe rundll32.exe PID 3116 wrote to memory of 668 3116 rundll32.exe rundll32.exe PID 3116 wrote to memory of 668 3116 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\111112.jpg.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\111112.jpg.dll,#12⤵
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Checks SCSI registry key(s)
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/668-2-0x0000000000000000-mapping.dmp