Analysis
-
max time kernel
67s -
max time network
69s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
17-01-2023 10:40
Static task
static1
General
-
Target
winserv.exe
-
Size
10.2MB
-
MD5
3f4f5a6cb95047fea6102bd7d2226aa9
-
SHA1
fc09dd898b6e7ff546e4a7517a715928fbafc297
-
SHA256
99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
-
SHA512
de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688
-
SSDEEP
196608:iz+UZcWP4jBrfWgEgIV8Rzy7Vj4FZvEo:i6UZcWWeVj4FZ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
winserv.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation winserv.exe -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
winserv.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 winserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" winserv.exe -
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
winserv.exewinserv.exetaskmgr.exepid process 2780 winserv.exe 2780 winserv.exe 2780 winserv.exe 2780 winserv.exe 2780 winserv.exe 2780 winserv.exe 4904 winserv.exe 4904 winserv.exe 4904 winserv.exe 4904 winserv.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
winserv.exewinserv.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 2780 winserv.exe Token: SeTakeOwnershipPrivilege 4904 winserv.exe Token: SeTcbPrivilege 4904 winserv.exe Token: SeTcbPrivilege 4904 winserv.exe Token: SeDebugPrivilege 3232 taskmgr.exe Token: SeSystemProfilePrivilege 3232 taskmgr.exe Token: SeCreateGlobalPrivilege 3232 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe 3232 taskmgr.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
winserv.exewinserv.exepid process 2780 winserv.exe 2780 winserv.exe 2780 winserv.exe 2780 winserv.exe 4904 winserv.exe 4904 winserv.exe 4904 winserv.exe 4904 winserv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\winserv.exe"C:\Users\Admin\AppData\Local\Temp\winserv.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\winserv.exeC:\Users\Admin\AppData\Local\Temp\winserv.exe -second2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2780-116-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-117-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-118-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-119-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-120-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-121-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-122-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-124-0x0000000000400000-0x0000000000E31000-memory.dmpFilesize
10.2MB
-
memory/2780-123-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-125-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-126-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-127-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-128-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-129-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-130-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-131-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-132-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-133-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-135-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-136-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-137-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-138-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-140-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-141-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-143-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-144-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-146-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-148-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-150-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-153-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-155-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-158-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-160-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-163-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-165-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-166-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-164-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-162-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-161-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-159-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-157-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-156-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-154-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-152-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-151-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-149-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-147-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-145-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-142-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-139-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-134-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-167-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-168-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-169-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-170-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-171-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-172-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-173-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-174-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-175-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-176-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-177-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-178-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-179-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-180-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2780-204-0x0000000000400000-0x0000000000E31000-memory.dmpFilesize
10.2MB
-
memory/4904-273-0x0000000000400000-0x0000000000E31000-memory.dmpFilesize
10.2MB