Overview

overview

10

Static

static

10

5NDw97wztb...cE.exe

windows10-1703-x64

4

Analysis

  • max time kernel
    61s
  • max time network
    60s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14-09-2022 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5NDw97wztbDc2C2Ph5S_3XcE.exe

  • Size

    400KB

  • MD5

    9519c85c644869f182927d93e8e25a33

  • SHA1

    eadc9026e041f7013056f80e068ecf95940ea060

  • SHA256

    f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

  • SHA512

    dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

  • SSDEEP

    6144:NrkuBHTtY9Jgfq80nzm5tBD2AsG8x0Ca0Hv06A0md0OUGHLzmijOceK2HSw3pXqC:NrkIT/y8T5PVsSnXOc+HSQJKLw

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5NDw97wztbDc2C2Ph5S_3XcE.exe
    "C:\Users\Admin\AppData\Local\Temp\5NDw97wztbDc2C2Ph5S_3XcE.exe"
    1⤵
      PID:2584
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2148
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1148

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2584-117-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-118-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-121-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-124-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-126-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-127-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-128-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-129-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-130-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-131-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-132-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-155-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-157-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2584-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp
        Filesize

        1.6MB

        Download