Analysis
-
max time kernel
239s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 13:55
Static task
static1
Behavioral task
behavioral1
Sample
AppFile-x64.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
AppFile-x64.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
300 seconds
General
-
Target
AppFile-x64.exe
-
Size
10.5MB
-
MD5
9990daf76962f060a6039f054c68aa67
-
SHA1
da3e2e6a2a479f0aa56ee725cb5977612d197d24
-
SHA256
d199cef7bd0ed49ad3f054b99fdd92a46c1aa4299649823e5e28fd272f247873
-
SHA512
c9a3b01129468934d0276f510161a35d4483296e5cc4462e30ba39fc870c18f3d10ecddcde589102decbc9cbb9ebe528aa1ee7d8615d2770950f620ab2570454
-
SSDEEP
98304:xwAww1pLx7A0H6MujBbyStG+G/sixT4ff6:xDXxUJHH6
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AppFile-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AppFile-x64.exe = "11000" AppFile-x64.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4472 AppFile-x64.exe 4472 AppFile-x64.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2524 taskmgr.exe Token: SeSystemProfilePrivilege 2524 taskmgr.exe Token: SeCreateGlobalPrivilege 2524 taskmgr.exe Token: 33 2524 taskmgr.exe Token: SeIncBasePriorityPrivilege 2524 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe 2524 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4472 AppFile-x64.exe 4472 AppFile-x64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AppFile-x64.exe"C:\Users\Admin\AppData\Local\Temp\AppFile-x64.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4472
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2524
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\4ef0f39762354491b2ea2d443c1ab8a8 /t 5112 /p 44721⤵PID:3048
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3236