Analysis
-
max time kernel
91s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2023, 02:38
Static task
static1
Behavioral task
behavioral1
Sample
Transmitted Service 7878459543.jpg
Resource
win7-20230220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Transmitted Service 7878459543.jpg
Resource
win10v2004-20230220-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
Transmitted Service 7878459543.jpg
-
Size
1.5MB
-
MD5
db043ffcd9d17c324387a692a21a17f3
-
SHA1
4845b5d0f0515793a541e0ea31b15974550c4956
-
SHA256
0239ccdda382768b8c0305da5c99151a78280da8e200a177d857d2985f316611
-
SHA512
bde7a26a44899c59ca312a9229e49c4914bffee36f5fa8bb1d79207ffbd77136097f1ff82d12e0286b63bf6f89605dd557fd1f2b5b6277a2ce8207812ae39577
-
SSDEEP
24576:O/yEl7qrraXbGmog3unWWOCB3zds5f0zNz:O/FluraL26D6DS5fQNz
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F3E3607E-95BF-418F-BC16-F8EDD84E0595}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A0E59BB5-01E7-47B2-98D2-AC344D18724C}.catalogItem svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1328 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1328 taskmgr.exe Token: SeSystemProfilePrivilege 1328 taskmgr.exe Token: SeCreateGlobalPrivilege 1328 taskmgr.exe Token: 33 1328 taskmgr.exe Token: SeIncBasePriorityPrivilege 1328 taskmgr.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe -
Suspicious use of SendNotifyMessage 58 IoCs
pid Process 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Transmitted Service 7878459543.jpg"1⤵PID:4744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:5012
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1328