Analysis
-
max time kernel
32s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2023, 15:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7005535e034576fdb66b5b32eb198b48d7755758e77bd66909f8dd7288c1e069.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
7005535e034576fdb66b5b32eb198b48d7755758e77bd66909f8dd7288c1e069.exe
-
Size
5.3MB
-
MD5
493640f022a7ac07ad4e8d6f2cd3740e
-
SHA1
4c4a1df308e415ab356d93ff4c5884f551e40cf5
-
SHA256
7005535e034576fdb66b5b32eb198b48d7755758e77bd66909f8dd7288c1e069
-
SHA512
d29b40298f00ba619a59f4aa7cec1bb1ec753df948b9fa50e7e158150ca21801783d701c8ed32a8e3811f138ad948b4077c8cf2b7da5b25917ec8eebe7435c26
-
SSDEEP
49152:U6q9fOpwcf1pHot9E4IaCf1kin7N0Iu1YES/N4ggvewaFSenC00qTQeVptYt1dmT:ofk3oC9n7N0Iu19SV4ISeLQevtYVmS
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2456 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2456 taskmgr.exe Token: SeSystemProfilePrivilege 2456 taskmgr.exe Token: SeCreateGlobalPrivilege 2456 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
pid Process 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe 2456 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7005535e034576fdb66b5b32eb198b48d7755758e77bd66909f8dd7288c1e069.exe"C:\Users\Admin\AppData\Local\Temp\7005535e034576fdb66b5b32eb198b48d7755758e77bd66909f8dd7288c1e069.exe"1⤵PID:1328
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2456