Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2023, 23:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PespSpoofer.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
PespSpoofer.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
PespSpoofer.exe
Resource
android-x64-20220823-en
android-10-x64
0 signatures
150 seconds
General
-
Target
PespSpoofer.exe
-
Size
4.0MB
-
MD5
8f89fbb0a0aeedfa6a8fce061026f755
-
SHA1
74cc9cecb3e05fb83e6d3f47b4c6f6fa07b39808
-
SHA256
87f80f12e2b4b78f27784e069c1218413666224eab1b8d50ba043af5551a24d4
-
SHA512
c7a44f513389ebeb4e8595506296e668c5c4b205baa4326ef711671de3e21d06eaf3afc11d5e9e88c2fadae198bed11be280a4a90a0a1e761f1fbb5f16d95ec4
-
SSDEEP
98304:TdNsK8ifJxh8inu5f+z8S7CCkqXf0F1+KH4kpc+DX/0HMxFKv:fsK8ifJjnYf+T2CkSI8KYODVxwv
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 checkip.dyndns.org -
Program crash 1 IoCs
pid pid_target Process procid_target 3768 948 WerFault.exe 82 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 948 PespSpoofer.exe 948 PespSpoofer.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3348 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 948 PespSpoofer.exe Token: SeDebugPrivilege 3348 taskmgr.exe Token: SeSystemProfilePrivilege 3348 taskmgr.exe Token: SeCreateGlobalPrivilege 3348 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe 3348 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PespSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\PespSpoofer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 948 -s 17562⤵
- Program crash
PID:3768
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 948 -ip 9481⤵PID:2056
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3348
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1036