Analysis
-
max time kernel
88s -
max time network
72s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
11/07/2023, 11:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
R3nzSkin.zip
Resource
win10-20230703-en
windows10-1703-x64
0 signatures
600 seconds
Behavioral task
behavioral2
Sample
R3nzSkin.dll
Resource
win10-20230703-en
windows10-1703-x64
1 signatures
600 seconds
Behavioral task
behavioral3
Sample
R3nzSkin_Injector.exe
Resource
win10-20230703-en
windows10-1703-x64
7 signatures
600 seconds
General
-
Target
R3nzSkin_Injector.exe
-
Size
267KB
-
MD5
2669731960af9a2e7d6b398ce06d6fde
-
SHA1
27b16b991096636aec9781a6be65792f34a5e136
-
SHA256
9dd5c1a111819825830a8b5136f083425d73883ea524a222332655d0a435d6a0
-
SHA512
237f0594309d4922f0db9f35e2d5167837b66b4774489b1ad9c180f5f8a730a0fa60751bb1df59b41176a167d201303cab559ab5609eb0b2f7f94f683a0aaabc
-
SSDEEP
6144:+h33GR4SO3jtmsVTc0/YxpXfGQZy9gAsm3oAEnG/2x6kzsGY/A4Sr+4SLmQKcHbl:u3R9JmsVTc0/YxxfGQZy9gAsm3oAEnGC
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe 4896 R3nzSkin_Injector.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4896 R3nzSkin_Injector.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4896 R3nzSkin_Injector.exe Token: SeDebugPrivilege 4896 R3nzSkin_Injector.exe Token: SeDebugPrivilege 4160 taskmgr.exe Token: SeSystemProfilePrivilege 4160 taskmgr.exe Token: SeCreateGlobalPrivilege 4160 taskmgr.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe -
Suspicious use of SendNotifyMessage 28 IoCs
pid Process 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe 4160 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\R3nzSkin_Injector.exe"C:\Users\Admin\AppData\Local\Temp\R3nzSkin_Injector.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4160