Overview
overview
10Static
static
10SysApps.rar
windows10-2004-x64
3SysApps/SHA256SUMS
windows10-2004-x64
1SysApps/Wi...64.exe
windows10-2004-x64
SysApps/be...0M.cmd
windows10-2004-x64
1SysApps/be...1M.cmd
windows10-2004-x64
1SysApps/config.json
windows10-2004-x64
3SysApps/po...le.cmd
windows10-2004-x64
1SysApps/rt...le.cmd
windows10-2004-x64
1SysApps/so...le.cmd
windows10-2004-x64
1SysApps/start.cmd
windows10-2004-x64
5SysApps/xmrig.exe
windows10-2004-x64
1Analysis
-
max time kernel
1541s -
max time network
1580s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2023 19:16
Behavioral task
behavioral1
Sample
SysApps.rar
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
SysApps/SHA256SUMS
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
SysApps/WinRing0x64.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
SysApps/benchmark_10M.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
SysApps/benchmark_1M.cmd
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
SysApps/config.json
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
SysApps/pool_mine_example.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
SysApps/rtm_ghostrider_example.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
SysApps/solo_mine_example.cmd
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
SysApps/start.cmd
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SysApps/xmrig.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
SysApps.rar
-
Size
2.7MB
-
MD5
d8aabcb45980942c2921ba3e38f6a2ab
-
SHA1
c012472480a5e00d4c14449446652c370fa5c060
-
SHA256
2e55752a5ce424f78521951780658ea572e78920fab1980c5047eb543d3dbec8
-
SHA512
779bb97a7f58896c7343971c3844ca90aaa468a31fee4e3a4af281798aebd5b68b0ba9ffe299d0230579b67e1dcd3ac2b1fb439d88878e720395288aed2a885e
-
SSDEEP
49152:g8c9wss9n2iEhIKWHjJAex1xb/woiBLrPIrUZ1r:g8c9wssZHHjJA411WPIrsr
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4088 taskmgr.exe Token: SeSystemProfilePrivilege 4088 taskmgr.exe Token: SeCreateGlobalPrivilege 4088 taskmgr.exe Token: 33 4088 taskmgr.exe Token: SeIncBasePriorityPrivilege 4088 taskmgr.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe -
Suspicious use of SendNotifyMessage 57 IoCs
pid Process 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe 4088 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4360 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SysApps.rar1⤵
- Modifies registry class
PID:4976
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4360
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4088