Analysis
-
max time kernel
199s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2023, 01:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Trojan.Win32.Generic.zip
Resource
win10v2004-20230831-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
Trojan.Win32.Generic.zip
-
Size
521KB
-
MD5
4613e252c168c1604ce0366f8022045b
-
SHA1
b2c614beba5c2084b6c65f9884ffa317444839a8
-
SHA256
e3ae1c0970439751d5b1b5327cc24f02613b779cdbdb46af3b102cf3245fffab
-
SHA512
bee5b171b21fe94ca94b3a28da8592fbc3527baaf956d34b12e752f228fe7c18b29f2936e9d8861c2fd8bfc7ddfc38e1e5cb3adc5c41d99ef2b3b4d7b3b8e19a
-
SSDEEP
12288:T85MVcw0PsBo+p7c1QMbNQ0BafYq8jvcylzxTOdHyEivzzLpxBQo:Q5CPF/p41jbK0BagbTciVTV33FxSo
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1804 taskmgr.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1804 taskmgr.exe Token: SeSystemProfilePrivilege 1804 taskmgr.exe Token: SeCreateGlobalPrivilege 1804 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Generic.zip1⤵PID:812
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4152
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1804
-
C:\Users\Admin\Desktop\UMR.exe"C:\Users\Admin\Desktop\UMR.exe"1⤵PID:3088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
521KB
MD54613e252c168c1604ce0366f8022045b
SHA1b2c614beba5c2084b6c65f9884ffa317444839a8
SHA256e3ae1c0970439751d5b1b5327cc24f02613b779cdbdb46af3b102cf3245fffab
SHA512bee5b171b21fe94ca94b3a28da8592fbc3527baaf956d34b12e752f228fe7c18b29f2936e9d8861c2fd8bfc7ddfc38e1e5cb3adc5c41d99ef2b3b4d7b3b8e19a