Analysis
-
max time kernel
103s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-es -
resource tags
arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
29/09/2023, 22:56
Static task
static1
Behavioral task
behavioral1
Sample
Saber_1.0.40_Installer_x64_2022.exe
Resource
win7-20230831-es
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Saber_1.0.40_Installer_x64_2022.exe
Resource
win10v2004-20230915-es
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
Saber_1.0.40_Installer_x64_2022.exe
-
Size
1.8MB
-
MD5
bd005022e28fe33f33b3a86b5c772961
-
SHA1
1b682be1ef2997865802e604542dca39dc4dd61b
-
SHA256
92945c9b6ff9eb4520511791dcba630417ead5f05ccccb15f4a9d875d022d01a
-
SHA512
b71371876d35b3db3413fab23ad8fd19f9c58b14c5d245a56ef19a6f3db3d3d03ad415fba80bb2fafcc46264cd8fb1d33261049a9e8cbf5f6331137cc56cd748
-
SSDEEP
24576:TSMQfXf+WEA1D8hPRK9mTNQRBjsBaVG7wKSnqS0WrePs:WMQfXeA1IR5ZyBjQoGR4t0f0
Score
5/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation Saber_1.0.40_Installer_x64_2022.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1048 taskmgr.exe Token: SeSystemProfilePrivilege 1048 taskmgr.exe Token: SeCreateGlobalPrivilege 1048 taskmgr.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe -
Suspicious use of SendNotifyMessage 57 IoCs
pid Process 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4520 Saber_1.0.40_Installer_x64_2022.exe 4520 Saber_1.0.40_Installer_x64_2022.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 216 wrote to memory of 4520 216 Saber_1.0.40_Installer_x64_2022.exe 84 PID 216 wrote to memory of 4520 216 Saber_1.0.40_Installer_x64_2022.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Saber_1.0.40_Installer_x64_2022.exe"C:\Users\Admin\AppData\Local\Temp\Saber_1.0.40_Installer_x64_2022.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\Saber_1.0.40_Installer_x64_2022.exe"C:\Users\Admin\AppData\Local\Temp\Saber_1.0.40_Installer_x64_2022.exe" /UAC2⤵
- Suspicious use of SetWindowsHookEx
PID:4520
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1048