Analysis
-
max time kernel
16s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2022 00:45
Static task
static1
Behavioral task
behavioral1
Sample
78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe
-
Size
1.4MB
-
MD5
1f00638214824577f764026104668add
-
SHA1
745a40c4bf8ea7da03171e1baccf14c9952ef6f1
-
SHA256
78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59
-
SHA512
0060d53be307fb12776ad95ac76667eac186a47dd1581b88f164cd0d734410d6f892fa655c776735ee7af090ff11c926685a30629382fb6f3972f84651c2e494
-
SSDEEP
24576:siMLG8NWP8751MuO72cRopWkQ1D56jrBMm+3ZN2LwEQq2KNIxH1FUmmkng:QLG2WP8751Y72/4kQtyrBz+3ZQwEH1Si
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exedescription pid process Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe Token: SeLoadDriverPrivilege 1512 78d2ae83a34339fd455214e96d9465360eff9c8a99d654f673350815f8f19c59.exe