Analysis
-
max time kernel
138s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14-01-2024 19:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BG3ModManager.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
BG3ModManager.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
BG3ModManager.exe
-
Size
710KB
-
MD5
428688620db9cbbee8cba82c72bb3ace
-
SHA1
7354c01e10233032538a11b4bb1edca1c427caeb
-
SHA256
851beb66763265cd7ae6f4eb97a23da10ad2950db5f5013238a1b4ecfce468af
-
SHA512
df7ef9d3a500451f234e27680b7ec9629e25c2993d27d5d833b3d2cc04be3814db255b1d24a6fa8b8b135d598139348605a3af0df98e62191ed5bc30b104c5c6
-
SSDEEP
12288:bEg6FwIvCpXlGkWiw2nyBL8JvRkiZ1vhd:oDwyCpXlGkUkyBLOkiX
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 460 taskmgr.exe Token: SeSystemProfilePrivilege 460 taskmgr.exe Token: SeCreateGlobalPrivilege 460 taskmgr.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe -
Suspicious use of SendNotifyMessage 49 IoCs
pid Process 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe 460 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BG3ModManager.exe"C:\Users\Admin\AppData\Local\Temp\BG3ModManager.exe"1⤵PID:8
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:460