Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
18/03/2024, 01:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe
- Size 643KB
- Sample240318-bfwk5sce78
- SHA256 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52
- MD5 e3a17c84071599220c987120e336906a
- SHA1 9c168a8f69c0f80b13cf4a8ff7b287910fd38056
- SHA512 a834c4bb289440a3ddd45eb429eaf76a96e0eeac014c370f0ede2b8625c1de1d071401f1120c942e6933fdab2a703b308ee7d5e52f348be4f2730b482c750852
- SSDEEP 12288:UWvWgQs69lZLKbAiqxERvU6S8HWK/a1KPesnWwNnuFBbSEWEEEHnmfY5JdutJRMa:Nv7mlHiqiaiHB
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\\\.exe" 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 1016 Taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe Token: 33 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe Token: SeIncBasePriorityPrivilege 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe Token: SeDebugPrivilege 1016 Taskmgr.exe Token: SeSystemProfilePrivilege 1016 Taskmgr.exe Token: SeCreateGlobalPrivilege 1016 Taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe 1016 Taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 804 wrote to memory of 1016 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 95 PID 804 wrote to memory of 1016 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 95 PID 804 wrote to memory of 1016 804 406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe"C:\Users\Admin\AppData\Local\Temp\406d179cb966d5f1140ca5d95df3202af516e649ca3aa50504b19d0479ab2a52.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1016
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Imminent\Path.dat
- Size 36B
- SHA256 bbc918e57061124449612cf763babcea913ee8e90d9275b3cfb35c70c25a8210
- MD5 51697ffee1aed82968498556e0405f14
- SHA1 1eafad9fa688a23ec8a06e3c46d0330d10c6ed63
- SHA512 6659f6ded8d4037666d44af349eb999418c9f8a1d13bc5bc20ec146fbf6db92cac737a9cd3c6664b1a331e74794bea0f82b77e132ad59725bed13ba16b40700d
- MD5 SHA1 SHA512