Analysis
-
max time kernel
210s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
25-10-2023 15:58
Static task
static1
Behavioral task
behavioral1
Sample
833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.exe
Resource
win10v2004-20231023-en
General
-
Target
833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.exe
-
Size
1.7MB
-
MD5
99a9fbd5fee72ce51585309390a46717
-
SHA1
ff39c56312090a909c2c0c82629c552a3b252a98
-
SHA256
833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa
-
SHA512
97f9a98fb48c8281818163d3dbe66fa246e1fe6a5a67f15175419992b0ca389cbe086e457177c21ce9c99ff05a1e0b508812cdf30220090a438dd8c94f73c6b7
-
SSDEEP
24576:R4nXubIQGyxbPV0db26Wmd0l4sv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdO7:Rqe3f61mZSffPMWrQ0ZkA
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmpfile_.exefile_.tmppid process 4592 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmp 980 file_.exe 4368 file_.tmp -
Loads dropped DLL 3 IoCs
Processes:
file_.tmppid process 4368 file_.tmp 4368 file_.tmp 4368 file_.tmp -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 38 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 880 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 880 taskmgr.exe Token: SeSystemProfilePrivilege 880 taskmgr.exe Token: SeCreateGlobalPrivilege 880 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmptaskmgr.exepid process 4592 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmp 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe 880 taskmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.exe833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmpfile_.exedescription pid process target process PID 428 wrote to memory of 4592 428 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.exe 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmp PID 428 wrote to memory of 4592 428 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.exe 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmp PID 428 wrote to memory of 4592 428 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.exe 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmp PID 4592 wrote to memory of 980 4592 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmp file_.exe PID 4592 wrote to memory of 980 4592 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmp file_.exe PID 4592 wrote to memory of 980 4592 833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmp file_.exe PID 980 wrote to memory of 4368 980 file_.exe file_.tmp PID 980 wrote to memory of 4368 980 file_.exe file_.tmp PID 980 wrote to memory of 4368 980 file_.exe file_.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.exe"C:\Users\Admin\AppData\Local\Temp\833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8DBNC.tmp\833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmp"C:\Users\Admin\AppData\Local\Temp\is-8DBNC.tmp\833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmp" /SL5="$801A0,831488,831488,C:\Users\Admin\AppData\Local\Temp\833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H9Q45.tmp\file_.exe"C:\Users\Admin\AppData\Local\Temp\is-H9Q45.tmp\file_.exe" /LANG=en /NA=Rh85hR643⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OHAMO.tmp\file_.tmp"C:\Users\Admin\AppData\Local\Temp\is-OHAMO.tmp\file_.tmp" /SL5="$202BC,1559708,780800,C:\Users\Admin\AppData\Local\Temp\is-H9Q45.tmp\file_.exe" /LANG=en /NA=Rh85hR644⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-3R29R.tmp\Helper.dllFilesize
2.0MB
MD54eb0347e66fa465f602e52c03e5c0b4b
SHA1fdfedb72614d10766565b7f12ab87f1fdca3ea81
SHA256c73e53cbb7b98feafe27cc7de8fdad51df438e2235e91891461c5123888f73cc
SHA5124c909a451059628119f92b2f0c8bcd67b31f63b57d5339b6ce8fd930be5c9baf261339fdd9da820321be497df8889ce7594b7bfaadbaa43c694156651bf6c1fd
-
C:\Users\Admin\AppData\Local\Temp\is-3R29R.tmp\botva2.dllFilesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
C:\Users\Admin\AppData\Local\Temp\is-3R29R.tmp\botva2.dllFilesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
C:\Users\Admin\AppData\Local\Temp\is-8DBNC.tmp\833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmpFilesize
3.0MB
MD50c229cd26910820581b5809c62fe5619
SHA128c0630385b21f29e3e2bcc34865e5d15726eaa0
SHA256abfa49a915d2e0a82561ca440365e6a2d59f228533b56a8f78addf000a1081b3
SHA512b8ff3dc65f7c0e03721572af738ec4886ba895dc70c1a41a3ce8c8abe0946d167cec71913017fd11d5892452db761ea88901a5a09a681ae779dd531edbb83a2a
-
C:\Users\Admin\AppData\Local\Temp\is-8DBNC.tmp\833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa.tmpFilesize
3.0MB
MD50c229cd26910820581b5809c62fe5619
SHA128c0630385b21f29e3e2bcc34865e5d15726eaa0
SHA256abfa49a915d2e0a82561ca440365e6a2d59f228533b56a8f78addf000a1081b3
SHA512b8ff3dc65f7c0e03721572af738ec4886ba895dc70c1a41a3ce8c8abe0946d167cec71913017fd11d5892452db761ea88901a5a09a681ae779dd531edbb83a2a
-
C:\Users\Admin\AppData\Local\Temp\is-H9Q45.tmp\file_.exeFilesize
2.3MB
MD5a72756cd2cde91985845503c32dbc8da
SHA13ba138ff8ded004c61cee998aacc5c9236a3fc88
SHA2562423f29134cdd64366bd5ce63072879188af4121a8d158fdf46dc6625613db0a
SHA512b95d3c87e435225230f8df092061f25a2da145b28bc28b569b7b202d611ee39e1f4d646e24a7604be890c841d3a6df668be6c128e1d5bb13c1d2117fe82cf54b
-
C:\Users\Admin\AppData\Local\Temp\is-H9Q45.tmp\file_.exeFilesize
2.3MB
MD5a72756cd2cde91985845503c32dbc8da
SHA13ba138ff8ded004c61cee998aacc5c9236a3fc88
SHA2562423f29134cdd64366bd5ce63072879188af4121a8d158fdf46dc6625613db0a
SHA512b95d3c87e435225230f8df092061f25a2da145b28bc28b569b7b202d611ee39e1f4d646e24a7604be890c841d3a6df668be6c128e1d5bb13c1d2117fe82cf54b
-
C:\Users\Admin\AppData\Local\Temp\is-OHAMO.tmp\file_.tmpFilesize
2.9MB
MD5623a3abd7b318e1f410b1e12a42c7b71
SHA188e34041850ec4019dae469adc608e867b936d21
SHA256fe1a4555d18617532248d2eaa8d3fcc2c74182f994a964a62cf418295e8554d3
SHA5129afea88e4617e0f11416c2a2c416a6aa2d5d1f702d98d2cc223b399736191a6d002d1b717020ca6aae09e835c6356b7ddafad71e101dacab15967d89a105e391
-
\??\c:\users\admin\appdata\local\temp\is-ohamo.tmp\file_.tmpFilesize
2.9MB
MD5623a3abd7b318e1f410b1e12a42c7b71
SHA188e34041850ec4019dae469adc608e867b936d21
SHA256fe1a4555d18617532248d2eaa8d3fcc2c74182f994a964a62cf418295e8554d3
SHA5129afea88e4617e0f11416c2a2c416a6aa2d5d1f702d98d2cc223b399736191a6d002d1b717020ca6aae09e835c6356b7ddafad71e101dacab15967d89a105e391
-
memory/428-51-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/428-2-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/428-7-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/428-0-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/880-44-0x0000015319A70000-0x0000015319A71000-memory.dmpFilesize
4KB
-
memory/880-24-0x0000015319A70000-0x0000015319A71000-memory.dmpFilesize
4KB
-
memory/880-41-0x0000015319A70000-0x0000015319A71000-memory.dmpFilesize
4KB
-
memory/880-40-0x0000015319A70000-0x0000015319A71000-memory.dmpFilesize
4KB
-
memory/880-43-0x0000015319A70000-0x0000015319A71000-memory.dmpFilesize
4KB
-
memory/880-42-0x0000015319A70000-0x0000015319A71000-memory.dmpFilesize
4KB
-
memory/880-23-0x0000015319A70000-0x0000015319A71000-memory.dmpFilesize
4KB
-
memory/880-46-0x0000015319A70000-0x0000015319A71000-memory.dmpFilesize
4KB
-
memory/880-45-0x0000015319A70000-0x0000015319A71000-memory.dmpFilesize
4KB
-
memory/880-19-0x0000015319A70000-0x0000015319A71000-memory.dmpFilesize
4KB
-
memory/980-67-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/980-53-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/980-20-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/4368-31-0x00000000024B0000-0x00000000024B1000-memory.dmpFilesize
4KB
-
memory/4368-54-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/4368-55-0x00000000024B0000-0x00000000024B1000-memory.dmpFilesize
4KB
-
memory/4368-57-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/4368-61-0x0000000002E10000-0x0000000002E1F000-memory.dmpFilesize
60KB
-
memory/4368-66-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/4592-50-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/4592-8-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/4592-9-0x0000000002720000-0x0000000002721000-memory.dmpFilesize
4KB
-
memory/4592-6-0x0000000002720000-0x0000000002721000-memory.dmpFilesize
4KB
-
memory/4592-27-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/4592-12-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB