Analysis
-
max time kernel
128s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-02-2024 16:08
Static task
static1
Behavioral task
behavioral1
Sample
UEPrereqSetup_x64.7z
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
UEPrereqSetup_x64.7z
Resource
win10v2004-20240221-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
UEPrereqSetup_x64.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
UEPrereqSetup_x64.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
UEPrereqSetup_x64.7z
-
Size
39.9MB
-
MD5
b7a5dc1dce76ca736ea878b65c690f52
-
SHA1
44b0c01fcd790f663b66952acb18e11b9cae9e45
-
SHA256
eed3682106a52740f17f27bfb177acb0ee88888096f93af0c14a2d5ae52e9e1d
-
SHA512
cdfa3b04961108d91fd38113ba6b9fd11298364baedfac868e383cad62054868d816dae629f4755b25193154de56f1a46654da5505cde0deefe39a962bf9b151
-
SSDEEP
786432:ovGWzOxPTuIaKO0SuzSeChLhnF3cTDprPLAEi2hvO7:ooaKKuzSeC1dF3cTD9DA1IvO7
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 4836 7zFM.exe Token: 35 4836 7zFM.exe Token: SeDebugPrivilege 1684 taskmgr.exe Token: SeSystemProfilePrivilege 1684 taskmgr.exe Token: SeCreateGlobalPrivilege 1684 taskmgr.exe Token: 33 1684 taskmgr.exe Token: SeIncBasePriorityPrivilege 1684 taskmgr.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 4836 7zFM.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe 1684 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2792 wrote to memory of 4836 2792 cmd.exe 89 PID 2792 wrote to memory of 4836 2792 cmd.exe 89
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\UEPrereqSetup_x64.7z1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\UEPrereqSetup_x64.7z"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4836
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1684