Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 19:30
Static task
static1
Behavioral task
behavioral1
Sample
e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
General
-
Target
e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe
-
Size
1.0MB
-
MD5
f78da74d5a3e58750613ac73fa693159
-
SHA1
10589e7140e51563bb4f513e60b78b6f5a330354
-
SHA256
e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055
-
SHA512
b89742fac25dc829fadb0d16d27b89e1fa94489c1d6f156337d4fd24e86aa4e67bd4923e6176c72f5874a3d5cb99fbb05278b76d9d8da1d529f02121efd47d31
-
SSDEEP
24576:BY5QsHPi4NNUowtPCVfkpXyy2Ixik181C8YN:BKbHPX/i/8622
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe File opened for modification C:\Windows\assembly\Desktop.ini e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe File created C:\Windows\assembly\Desktop.ini e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe File opened for modification C:\Windows\assembly\Desktop.ini e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1500 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe 1500 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1500 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe 4204 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1500 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe Token: SeDebugPrivilege 4204 Taskmgr.exe Token: SeSystemProfilePrivilege 4204 Taskmgr.exe Token: SeCreateGlobalPrivilege 4204 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe 4204 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1500 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1500 wrote to memory of 4204 1500 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe 79 PID 1500 wrote to memory of 4204 1500 e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe"C:\Users\Admin\AppData\Local\Temp\e4de496d2f4c9492df3639e6ec3d2889713ab64f0523777c099687b21ae3b055.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4204
-