Analysis
-
max time kernel
159s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GH Injector SWHEX - x64.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
GH Injector SWHEX - x64.exe
-
Size
27KB
-
MD5
be52febf3f7e44375d814d726ed50d24
-
SHA1
f9f58bd8bb74296c0d50611e6b754133ad216c48
-
SHA256
db24c74489b05cf6253d1041e3fc43cb08c439dd4794c67e6725ab47e95e30a1
-
SHA512
2643512c8ec6b828b464a8768467b31c0d3a3556654565b6070eed1e3e270d9bc1e8369e36d78cc7ef46e75a080e6f7c18ed778c7506d710f1262d5bed2290a5
-
SSDEEP
768:wvlQUD7BugNGe8SP4uImHpeH4u5VzG3V/:m7UufFwuH7F/
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2092 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2092 taskmgr.exe Token: SeSystemProfilePrivilege 2092 taskmgr.exe Token: SeCreateGlobalPrivilege 2092 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GH Injector SWHEX - x64.exe"C:\Users\Admin\AppData\Local\Temp\GH Injector SWHEX - x64.exe"1⤵PID:4616
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:2612