Analysis
-
max time kernel
176s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 02:50
Behavioral task
behavioral1
Sample
4df0310f778223cc093bc1d5cff5c914.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4df0310f778223cc093bc1d5cff5c914.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
4df0310f778223cc093bc1d5cff5c914.exe
-
Size
197KB
-
MD5
4df0310f778223cc093bc1d5cff5c914
-
SHA1
7a96f852b5affa174d6af48b375d0b10e392dce7
-
SHA256
0a8b35fb93409ccfc2ecc27536526652a196009ab8b76a6d312e30b046c818f7
-
SHA512
9468886f9c56d01ef3735e3fecf7b6fa3e1866dfc94143a33a01bc65c827d1150af7f60306887e03286bc63201da035c5b68fd95a2131dcbd0d0aca197cd7aca
-
SSDEEP
3072:riK4Gz58kmdpRrHTNI05iapUqYrSywO5SP9eH8izzY7TYNLW+c6zR/g:rZsjrz78rV+9OvYyLxc+
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3288-0-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral2/memory/3288-2-0x0000000000400000-0x0000000000445000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2440 3288 WerFault.exe 86 -
Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters 4df0310f778223cc093bc1d5cff5c914.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 4df0310f778223cc093bc1d5cff5c914.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 4df0310f778223cc093bc1d5cff5c914.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters 4df0310f778223cc093bc1d5cff5c914.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service 4df0310f778223cc093bc1d5cff5c914.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service 4df0310f778223cc093bc1d5cff5c914.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service 4df0310f778223cc093bc1d5cff5c914.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters 4df0310f778223cc093bc1d5cff5c914.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service 4df0310f778223cc093bc1d5cff5c914.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 3288 4df0310f778223cc093bc1d5cff5c914.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4df0310f778223cc093bc1d5cff5c914.exe"C:\Users\Admin\AppData\Local\Temp\4df0310f778223cc093bc1d5cff5c914.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 3042⤵
- Program crash
PID:2440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3288 -ip 32881⤵PID:316