Analysis
-
max time kernel
108s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 18:16
Static task
static1
Behavioral task
behavioral1
Sample
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe
-
Size
248KB
-
MD5
738314aa6e07f9a625e4774ac1243a79
-
SHA1
0a7ab8cc60b04e66be11eb41672991482b9c0656
-
SHA256
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579
-
SHA512
18ea6d2398ea5b858a24f51221009622dad2770177ddbeb9ec3e3736b544e1b854f35baa19d741f76f9eb181dd426df11cc64e8f0c465cd3cf8b8d381211a581
-
SSDEEP
6144:1d4JCWlqIEWqfHNtqIl6lX5YlSMoNq9GnN5tyflgAB4:YdQHf6lelSMGq4NHyfeAB4
Score
10/10
Malware Config
Signatures
-
Clop
Ransomware discovered in early 2019 which has been actively developed since release.
-
Detects Clop payload 1 IoCs
resource yara_rule behavioral1/memory/664-132-0x0000000000400000-0x000000000043E000-memory.dmp family_clop -
Program crash 3 IoCs
pid pid_target Process procid_target 1332 664 WerFault.exe 82 1164 664 WerFault.exe 82 2152 4224 WerFault.exe 30 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2528 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2528 taskmgr.exe Token: SeSystemProfilePrivilege 2528 taskmgr.exe Token: SeCreateGlobalPrivilege 2528 taskmgr.exe Token: 33 2528 taskmgr.exe Token: SeIncBasePriorityPrivilege 2528 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe 2528 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe"C:\Users\Admin\AppData\Local\Temp\0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe"1⤵PID:664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 4402⤵
- Program crash
PID:1332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 4482⤵
- Program crash
PID:1164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 664 -ip 6641⤵PID:204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 664 -ip 6641⤵PID:5040
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 560 -p 4224 -ip 42241⤵PID:3380
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4224 -s 24081⤵
- Program crash
PID:2152
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2528