Analysis

  • max time kernel
    30s
  • max time network
    29s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/02/2024, 00:04

Errors

Reason
Machine shutdown

General

  • Target

    png.png

  • Size

    166KB

  • MD5

    b99c37dbbe519a317b7c179a44fbbdda

  • SHA1

    5eb53a3d30268878471329ea5c8a9d5bff5ef009

  • SHA256

    cb66dcf2caf657bcbfb3bd66539ec45feed79c31dcfabce3ff680ad48f5af1a3

  • SHA512

    1dc8a21b1d1436d972a5cc6591fa9fa0fb52f4c4114e7300c07ba1e7eec4d05b8cbcf4c6e5b30fd203fd12701911060d0f249dd0df50ae3bf0fae5582e6a2f8b

  • SSDEEP

    3072:WTo5jCr16ON+RYSpNl/SmBN66MqjZqnSagf9Bj04Yv9MfanM46eqVPzJ83ERYIzp:WToEx6o+6WNtSc46XjAShf9Bg4KWfgan

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\png.png
    1⤵
      PID:196
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2248
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0 /state0:0xa3aa1855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2220

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads