Analysis
- max time kernel
4265059s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/01/2022, 18:15
Static task
static1
Behavioral task
behavioral1
Sample
666.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
666.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 666.exe
- Size 380KB
- Sample220117-wvxf7sbff4
- SHA256 e6c357c2c7c70b4630dbdcd86df2d98ed28cbd47a9efcbf727fe0fdbc5d5fefa
- MD5 fae2a60811bd10fd137f16c183ee1bc5
- SHA1 a119e25fbe0e1419931d0c07ec37c9c7e0631679
- SHA512 89b4a331b7170da8f3dad46cbd524c78a30d0edda0985b0a5cf009cae3a657121aa39445b578177caa2f81d1fab5476cfc21c828b2dcc9b104a12745a3cd7c11
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 666.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 666.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotification.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotification.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe 4012 666.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3696 MusNotification.exe Token: SeCreatePagefilePrivilege 3696 MusNotification.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4012 666.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\666.exe"C:\Users\Admin\AppData\Local\Temp\666.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4012
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3696