Resubmissions
27-03-2023 07:51
230327-jp31kscd46 1027-03-2023 07:48
230327-jm8s2sed6s 127-03-2023 07:35
230327-jeqmhacc77 10Analysis
-
max time kernel
46s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-de -
resource tags
arch:x64arch:x86image:win10v2004-20230221-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
27-03-2023 07:48
Static task
static1
Behavioral task
behavioral1
Sample
file.zip
Resource
win10v2004-20230221-de
windows10-2004-x64
5 signatures
1800 seconds
General
-
Target
file.zip
-
Size
156KB
-
MD5
e332603f908c72cff39a81db5a409694
-
SHA1
b7c19049e2cd08e26636826b671476fb72b0e698
-
SHA256
2b48a940abdbb712e70e2da9c2b309a30bd7e8446fb2bc7e913155da7606aa3f
-
SHA512
dda866a3e777c2c0078bb9309aa9cb2ea9da6c2a8a67e27874eb516cde964375d0e162538d247d4288d4803ff55bf4311b0bb00102cccdd67e49c3a1e42d8f3e
-
SSDEEP
3072:cU8xXqbMyAheGclNC2lSPjMmqkH2zMbJqWHBYH7F4CgwkIyWXuDni6:6xXhy6eGcvDLrkWzkHB87F49wkLp
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
taskmgr.exepid process 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 4216 taskmgr.exe Token: SeSystemProfilePrivilege 4216 taskmgr.exe Token: SeCreateGlobalPrivilege 4216 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
Processes:
taskmgr.exepid process 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
taskmgr.exepid process 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe 4216 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\file.zip1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4216-133-0x00000190C6E60000-0x00000190C6E61000-memory.dmpFilesize
4KB
-
memory/4216-134-0x00000190C6E60000-0x00000190C6E61000-memory.dmpFilesize
4KB
-
memory/4216-135-0x00000190C6E60000-0x00000190C6E61000-memory.dmpFilesize
4KB
-
memory/4216-139-0x00000190C6E60000-0x00000190C6E61000-memory.dmpFilesize
4KB
-
memory/4216-140-0x00000190C6E60000-0x00000190C6E61000-memory.dmpFilesize
4KB
-
memory/4216-141-0x00000190C6E60000-0x00000190C6E61000-memory.dmpFilesize
4KB
-
memory/4216-143-0x00000190C6E60000-0x00000190C6E61000-memory.dmpFilesize
4KB
-
memory/4216-142-0x00000190C6E60000-0x00000190C6E61000-memory.dmpFilesize
4KB
-
memory/4216-144-0x00000190C6E60000-0x00000190C6E61000-memory.dmpFilesize
4KB
-
memory/4216-145-0x00000190C6E60000-0x00000190C6E61000-memory.dmpFilesize
4KB