Analysis
-
max time kernel
184s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43.exe
Resource
win10v2004-20221111-en
General
-
Target
8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43.exe
-
Size
88KB
-
MD5
6d5f527d15977dbb16b9b2bb471e3fe1
-
SHA1
615b4b222b3d0af32c8a2c0897e2d1c658a51c94
-
SHA256
8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43
-
SHA512
68b92bda4b59bf5d1359afe2752cb257cc505c733fa6c383417f164a22ba488d8aa2ea86aa9417aa43c764aee977b1bcaf740e7df1f838aa9184d03018cfca7a
-
SSDEEP
1536:rk3FSROdGa2ibckTaf/pEuYUCW0VAq/sU:rk3FFJ2ibLTc/pEuYrW0VAqUU
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
Processes:
8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43.exedescription ioc process File created C:\WINDOWS\SysWOW64\SonicMaster.exe 8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43.exe File opened for modification C:\WINDOWS\SysWOW64\SonicMaster.exe 8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Taskmgr.exepid process 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Taskmgr.exepid process 1484 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Taskmgr.exedescription pid process Token: SeDebugPrivilege 1484 Taskmgr.exe Token: SeSystemProfilePrivilege 1484 Taskmgr.exe Token: SeCreateGlobalPrivilege 1484 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43.exeTaskmgr.exepid process 2164 8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Taskmgr.exepid process 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
launchtm.exedescription pid process target process PID 2112 wrote to memory of 1484 2112 launchtm.exe Taskmgr.exe PID 2112 wrote to memory of 1484 2112 launchtm.exe Taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43.exe"C:\Users\Admin\AppData\Local\Temp\8695a5442bbbedcf91c392a75201e70e7624ca5c9319a31a1631d018f72eeb43.exe"1⤵
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:2164
-
C:\Windows\system32\launchtm.exelaunchtm.exe /21⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe" /22⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1484