75a3295f8c688359fcb7555b80e3f71ee42c5ac1d4525a39b2571107acf06a45

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

scripts/weapon.lua
Size

277B
MD5

402a9279c76afb2c5977cf97d270c3d1
SHA1

4cd6474f3cbf9c3ca26277d5691460e8744aae59
SHA256

20d2e8d52504c96dcb846b08da138418048ed3b58128b05ddf1bde09694c5c14
SHA512

7357aff15e11de58da79a4eaa603c5ad7fb16ec426e71358e87dd14862d19c44b80896c0e66766479978bb0ba88704457b5356f9f86f6f4af41a39c52ffa45db

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1628	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	taskmgr.exe
Token: SeSystemProfilePrivilege	3248	taskmgr.exe
Token: SeCreateGlobalPrivilege	3248	taskmgr.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe
3248	taskmgr.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 1628	4696	OpenWith.exe	92
PID 4696 wrote to memory of 1628	4696	OpenWith.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\scripts\weapon.lua
1⤵
- Modifies registry class
PID:1664

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\scripts\weapon.lua
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1628

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3248-0-0x00000253AC480000-0x00000253AC481000-memory.dmp

Filesize
4KB

Download
memory/3248-1-0x00000253AC480000-0x00000253AC481000-memory.dmp

Filesize
4KB

Download
memory/3248-2-0x00000253AC480000-0x00000253AC481000-memory.dmp

Filesize
4KB

Download
memory/3248-12-0x00000253AC480000-0x00000253AC481000-memory.dmp

Filesize
4KB

Download
memory/3248-11-0x00000253AC480000-0x00000253AC481000-memory.dmp

Filesize
4KB

Download
memory/3248-10-0x00000253AC480000-0x00000253AC481000-memory.dmp

Filesize
4KB

Download
memory/3248-9-0x00000253AC480000-0x00000253AC481000-memory.dmp

Filesize
4KB

Download
memory/3248-8-0x00000253AC480000-0x00000253AC481000-memory.dmp

Filesize
4KB

Download
memory/3248-7-0x00000253AC480000-0x00000253AC481000-memory.dmp

Filesize
4KB

Download
memory/3248-6-0x00000253AC480000-0x00000253AC481000-memory.dmp

Filesize
4KB

Download