Analysis
-
max time kernel
53s -
max time network
25s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-02-2024 13:33
Static task
static1
Behavioral task
behavioral1
Sample
Sig.exe
Resource
win11-20240214-en
windows11-21h2-x64
5 signatures
1800 seconds
General
-
Target
Sig.exe
-
Size
3.9MB
-
MD5
55441e6aa25c5a6bd64ef9a2e1046a31
-
SHA1
282ba5b1cf0f0a5d7642df42ec6e73e77422ed5d
-
SHA256
56c001c50419ac80610dd4e6fe039ff01ae8e6f008e2d9511bf13234ecbf1f36
-
SHA512
dd35ad183a286be2793f36efaf7506b484fe657cbf89a0d3d3927bcc19f3a620c4da396cbbdfc07bf316e4058c859a594f8c8baf24a7210e267de5a5fe43e9eb
-
SSDEEP
98304:6LkCqKXMTTuvn4LNfuWToj9ghi1RebMIg9Cbk/V4Vs4LI:ukCqwA7ojDIg9Cbk/V4V3LI
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1520 Taskmgr.exe Token: SeSystemProfilePrivilege 1520 Taskmgr.exe Token: SeCreateGlobalPrivilege 1520 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe -
Suspicious use of SendNotifyMessage 51 IoCs
pid Process 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe 1520 Taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sig.exe"C:\Users\Admin\AppData\Local\Temp\Sig.exe"1⤵PID:1168
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1520