Analysis
- max time kernel
688s - max time network
728s - platform
windows10-2004_x64 - resource
win10v2004-20220414-es - submitted
12/05/2022, 16:44
Static task
static1
Behavioral task
behavioral1
Sample
SkZHmOiYyBX.exe
Resource
win7-20220414-es
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SkZHmOiYyBX.exe
Resource
win10v2004-20220414-es
windows10-2004_x64
0 signatures
0 seconds
General
- Target SkZHmOiYyBX.exe
- Size 363.5MB
- Sample220512-t85nmadba8
- SHA256 bfcabc9c67a9e8798f7f3f08fc76d46c9e76320fcb9bc33ad5092c1513fc7eae
- MD5 1e28899f46a412d728e3d97653c227b8
- SHA1 0edcfbeab66f76df6475c291293e18d5b67f4112
- SHA512 3efa06961633f99504504f2b3f9309f8338616b68ed85993d2f69d6f2802cd8d91b8190c9ec8eef55456e3eafda8231026005528fc3e97063f8db727936a94ba
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run SkZHmOiYyBX.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RolandoArruda = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SkZHmOiYyBX.exe" SkZHmOiYyBX.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AureliaRocha = "cmd.exe /c start C:\\Users\\Admin\\AppData\\Local\\Temp\\SkZHmOiYyBX.exe" SkZHmOiYyBX.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: SkZHmOiYyBX.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 ipinfo.io - Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum SkZHmOiYyBX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count SkZHmOiYyBX.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 SkZHmOiYyBX.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe 4660 SkZHmOiYyBX.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe Token: SeIncBasePriorityPrivilege 4660 SkZHmOiYyBX.exe Token: 33 4660 SkZHmOiYyBX.exe