Resubmissions
13-01-2022 13:19
220113-qkhx6sade2 412-09-2021 07:40
210912-jhysaacbd3 1012-09-2021 07:40
210912-jhp55sfbbr 1012-09-2021 07:39
210912-jhc6kscbd2 1012-09-2021 07:39
210912-jg161sfbbp 1012-09-2021 07:38
210912-jgmnmafbbn 10Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-01-2022 13:19
Static task
static1
Behavioral task
behavioral1
Sample
Dot.Tk.123.ticket.keygen.by.CORE.bin.zip
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
Dot.Tk.123.ticket.keygen.by.CORE.bin.zip
-
Size
6.1MB
-
MD5
e0e12184991eab552692c03d6853e425
-
SHA1
2d31a35b75a09cb706bcec021031d0988e3aee97
-
SHA256
01ecd5534093150c638a818c19f30b7264b3e6e1020edb7a2b17a35f793c6bb1
-
SHA512
7281e166557eda5505122254ebb50b98ce572d422899f7ecce9d9b95f6f4aa93aaed87ec5511e5a30249be12f47840601edd8f18da23bf9339611516dac47527
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc Process File created C:\Windows\rescache\_merged\4183903823\97717462.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid Process 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid Process Token: SeDebugPrivilege 752 taskmgr.exe Token: SeSystemProfilePrivilege 752 taskmgr.exe Token: SeCreateGlobalPrivilege 752 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Dot.Tk.123.ticket.keygen.by.CORE.bin.zip1⤵PID:2352
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:752