Resubmissions
25/06/2021, 19:04
210625-3q4myth2ca1019/01/2021, 19:22
210119-74yjheq4bx1017/01/2021, 19:15
210117-72yv52cjkn1008/11/2020, 18:23
201108-mnckpgycdx6Analysis
- max time kernel
42s - max time network
112s - platform
windows10_x64 - resource
win10v20210408 - submitted
25/06/2021, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe
- Size 711KB
- Sample210625-3q4myth2ca
- SHA256 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440
- MD5 c11c38a2dc17558e70902eeb958ffdca
- SHA1 dd16882a61da57e21389e0f856740e6d3c8e2b49
- SHA512 5483a32cc11c9d1de4859ab859c41e163480e8b98390afe106fab76734a85a983630f20d6572e088d7845cd2cc6944e685344725fe9798c20cc579ed237fef9f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE" 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE" 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\CSRLT.EXE 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe File opened for modification C:\Windows\SysWOW64\CSRLT.EXE 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\MSBLT.EXE 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe File opened for modification C:\Windows\MSBLT.EXE 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3520 taskmgr.exe Token: SeSystemProfilePrivilege 3520 taskmgr.exe Token: SeCreateGlobalPrivilege 3520 taskmgr.exe Token: 33 3520 taskmgr.exe Token: SeIncBasePriorityPrivilege 3520 taskmgr.exe - Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe - Suspicious use of SendNotifyMessage 50 IoCs
pid Process 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe 3520 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe"C:\Users\Admin\AppData\Local\Temp\192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:3628
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3520
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe"C:\Users\Admin\AppData\Local\Temp\192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe"1⤵PID:3940