Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbb98d0aa782388fd4fc13078251d108.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
dbb98d0aa782388fd4fc13078251d108.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
dbb98d0aa782388fd4fc13078251d108.exe
-
Size
440KB
-
MD5
dbb98d0aa782388fd4fc13078251d108
-
SHA1
e1e15929307d22bd4f6b7c28528c29958e66eee2
-
SHA256
b8699065889b97210d65f3f31ba0eddf40adb4c11fefa938ee5002d9bb73c75f
-
SHA512
f194c0d2683c2f5ec7f44bf82187abe943a540cd5b1f55c3e20df3cc1075b3e46a6374aebadcba57879fe7db4c1d954b36a9dcbd012d1faabddccd4db7ce594f
-
SSDEEP
6144:takFq8nVj5phXowVf3pIf5c8Zs9xj3cHv3vYpb7sg/vE/v7NVYOj6lTMfTxv8Z9p:LFNnNhRlufWjsYpb7sgHOv7RMq1vO9p
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dbb98d0aa782388fd4fc13078251d108.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion dbb98d0aa782388fd4fc13078251d108.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1" sihost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1752 dbb98d0aa782388fd4fc13078251d108.exe Token: SeDebugPrivilege 316 dwm.exe Token: SeShutdownPrivilege 316 dwm.exe Token: SeCreatePagefilePrivilege 316 dwm.exe Token: SeShutdownPrivilege 316 dwm.exe Token: SeCreatePagefilePrivilege 316 dwm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe 1752 dbb98d0aa782388fd4fc13078251d108.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1752 wrote to memory of 3092 1752 dbb98d0aa782388fd4fc13078251d108.exe 94 PID 1752 wrote to memory of 3092 1752 dbb98d0aa782388fd4fc13078251d108.exe 94 PID 1752 wrote to memory of 3092 1752 dbb98d0aa782388fd4fc13078251d108.exe 94 PID 1752 wrote to memory of 3092 1752 dbb98d0aa782388fd4fc13078251d108.exe 94 PID 1752 wrote to memory of 3092 1752 dbb98d0aa782388fd4fc13078251d108.exe 94 PID 1752 wrote to memory of 3092 1752 dbb98d0aa782388fd4fc13078251d108.exe 94 PID 1752 wrote to memory of 3092 1752 dbb98d0aa782388fd4fc13078251d108.exe 94 PID 1752 wrote to memory of 316 1752 dbb98d0aa782388fd4fc13078251d108.exe 6 PID 1752 wrote to memory of 2592 1752 dbb98d0aa782388fd4fc13078251d108.exe 60 PID 1752 wrote to memory of 2692 1752 dbb98d0aa782388fd4fc13078251d108.exe 59 PID 1752 wrote to memory of 2800 1752 dbb98d0aa782388fd4fc13078251d108.exe 56
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:316
-
C:\Users\Admin\AppData\Local\Temp\dbb98d0aa782388fd4fc13078251d108.exe"C:\Users\Admin\AppData\Local\Temp\dbb98d0aa782388fd4fc13078251d108.exe"1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\system32\rundll32.exe-g yurwfca.dll2⤵PID:3092
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2692
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Modifies registry class
PID:2592