Analysis
-
max time kernel
68s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
23-09-2022 06:08
Static task
static1
Behavioral task
behavioral1
Sample
AtlasInternalUpdater.exe
Resource
win10-20220812-en
General
-
Target
AtlasInternalUpdater.exe
-
Size
511KB
-
MD5
9af5433d57bb7891d7f31a0a06a51c82
-
SHA1
656f8568b85943c4fd92e45b78b9be6d3062d765
-
SHA256
4080e36ecb4ab1965680ee4453b0b95f5216d8e80cf0dad98dcb0976dc336917
-
SHA512
6304a05bc2eb3163ce0f2f9ea83e3af5e87a8fe8df66e0236ed775a85503f9f6f9017741473decc0b735d76a26e3bf19644337aa4d8d77fd0fd3b4df5be682a9
-
SSDEEP
12288:r61E6h1Ze85HBF9BE/CtDgl8oNUZzV8jz881b7EjgTDqsUl1IKieu:r6y6h14iwEETDqsUl6Kie
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
taskmgr.exepid process 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 4748 taskmgr.exe Token: SeSystemProfilePrivilege 4748 taskmgr.exe Token: SeCreateGlobalPrivilege 4748 taskmgr.exe Token: 33 4748 taskmgr.exe Token: SeIncBasePriorityPrivilege 4748 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe 4748 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
AtlasInternalUpdater.exedescription pid process target process PID 2688 wrote to memory of 1816 2688 AtlasInternalUpdater.exe cmd.exe PID 2688 wrote to memory of 1816 2688 AtlasInternalUpdater.exe cmd.exe PID 2688 wrote to memory of 1816 2688 AtlasInternalUpdater.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AtlasInternalUpdater.exe"C:\Users\Admin\AppData\Local\Temp\AtlasInternalUpdater.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1816-157-0x0000000000000000-mapping.dmp
-
memory/1816-162-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/1816-161-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/1816-160-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/1816-159-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/1816-158-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-139-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-142-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-123-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-124-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-125-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-126-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-127-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-129-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-128-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-130-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-131-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-132-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-133-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-134-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-135-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-137-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-136-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-138-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-115-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-140-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-141-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-122-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-143-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-144-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-145-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-146-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-147-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-148-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-149-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-150-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-151-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-152-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-153-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-154-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-155-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-156-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-121-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-120-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-119-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-118-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-117-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB
-
memory/2688-116-0x00000000774C0000-0x000000007764E000-memory.dmpFilesize
1.6MB