Analysis
-
max time kernel
22s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 10:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0aa7571d06532fea194a62091a812557a8f8b8d616ffd923df766a4871f4a918.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
0aa7571d06532fea194a62091a812557a8f8b8d616ffd923df766a4871f4a918.exe
-
Size
5.2MB
-
MD5
dd6931fda2df843249a5df40b8808387
-
SHA1
e9d6bdca9bb7fd010b44111771818d9965072212
-
SHA256
0aa7571d06532fea194a62091a812557a8f8b8d616ffd923df766a4871f4a918
-
SHA512
3bccfa6e17f47fe43eef75e8d19fb6e3328230ef240593031cfe9e00ffbb5f9f095ff2fc48fff0f9935753fa7ee6e78968d17cfdc80d25c5eccf4708dc94224b
-
SSDEEP
49152:q42WxCBoOsDSSSQ4YOz15YYpnHXf+8Pib0ARc73OamQX2pqkzfAp01Sm:q42mCp+jN4Jz1/f+C6Vqm
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4484 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4484 taskmgr.exe Token: SeSystemProfilePrivilege 4484 taskmgr.exe Token: SeCreateGlobalPrivilege 4484 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe 4484 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aa7571d06532fea194a62091a812557a8f8b8d616ffd923df766a4871f4a918.exe"C:\Users\Admin\AppData\Local\Temp\0aa7571d06532fea194a62091a812557a8f8b8d616ffd923df766a4871f4a918.exe"1⤵PID:640
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4484