Analysis
-
max time kernel
30s -
max time network
29s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
03/02/2024, 00:04
Static task
static1
Behavioral task
behavioral1
Sample
png.png
Resource
win10-20231215-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
png.png
Resource
win10v2004-20231215-en
3 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
png.png
-
Size
166KB
-
MD5
b99c37dbbe519a317b7c179a44fbbdda
-
SHA1
5eb53a3d30268878471329ea5c8a9d5bff5ef009
-
SHA256
cb66dcf2caf657bcbfb3bd66539ec45feed79c31dcfabce3ff680ad48f5af1a3
-
SHA512
1dc8a21b1d1436d972a5cc6591fa9fa0fb52f4c4114e7300c07ba1e7eec4d05b8cbcf4c6e5b30fd203fd12701911060d0f249dd0df50ae3bf0fae5582e6a2f8b
-
SSDEEP
3072:WTo5jCr16ON+RYSpNl/SmBN66MqjZqnSagf9Bj04Yv9MfanM46eqVPzJ83ERYIzp:WToEx6o+6WNtSc46XjAShf9Bg4KWfgan
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2248 taskmgr.exe Token: SeSystemProfilePrivilege 2248 taskmgr.exe Token: SeCreateGlobalPrivilege 2248 taskmgr.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe -
Suspicious use of SendNotifyMessage 31 IoCs
pid Process 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2220 LogonUI.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\png.png1⤵PID:196
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2248
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3aa1855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2220