Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16/11/2022, 11:58
Behavioral task
behavioral1
Sample
9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe
-
Size
6.0MB
-
MD5
127e7dce984cc0acea750746b485c101
-
SHA1
2e920f4583c38f811fdad739ebaf5064badec42d
-
SHA256
9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d
-
SHA512
408196e79f98a68961c478d0125f5c7b76b9979c26c23a767fc605bd2fc5cdad64a72d3a3c06e2c934f3c86b70e662b3bd27a4b818dc75f4daea923c586d4eb6
-
SSDEEP
98304:eMGA/GKxx3TknUXUGG5ghUA2dqGJSkIX0BLNYDodDygooqgcZmOf9XhzuALXwHK:eMGA/FxVTp7MzA28GJRVlNGabiZv1Xhk
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3080-132-0x0000000000400000-0x0000000000E0A000-memory.dmp vmprotect behavioral1/memory/3080-134-0x0000000000400000-0x0000000000E0A000-memory.dmp vmprotect behavioral1/memory/3080-136-0x0000000000400000-0x0000000000E0A000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\R: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\S: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\A: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\E: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\H: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\W: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\Y: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\I: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\T: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\V: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\L: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\N: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\P: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\Q: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\X: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\B: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\G: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\J: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\Z: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\U: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\F: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\K: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe File opened (read-only) \??\O: 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3080 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe 3080 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe 3080 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe 3080 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5044 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3080 9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe Token: SeDebugPrivilege 5044 taskmgr.exe Token: SeSystemProfilePrivilege 5044 taskmgr.exe Token: SeCreateGlobalPrivilege 5044 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe 5044 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe"C:\Users\Admin\AppData\Local\Temp\9f84be3a53d5f2a03a9ec2e60093c70293e15fd91addeb3936fd1f8c3b013b1d.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5044