Analysis
-
max time kernel
25s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 14:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Setup.exe
-
Size
3.9MB
-
MD5
54f17951fae1d5db228771a5fbe1d6d1
-
SHA1
820f2034e6512ca380567ecda1f33b55b87afa1a
-
SHA256
5455b859c0d470b3f3371eedfcff8ae0d01bfafb2445e676f18c7a34a47ab518
-
SHA512
a8ba6f47ce49da5011a2ef332b1f5a393ca8db5303d5b0552560eb9f3b4dec68a7a2388192569296e8eca9497940de1c67885caec07cf8906eba90d06e242255
-
SSDEEP
49152:j5o8/AXbDv/v6UCTmoHcJjTzvWGIy+iF/h8895L0mzX6ZGKjLX:q5XfLUmERiFu/
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2356 set thread context of 2080 2356 Setup.exe 103 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1408 taskmgr.exe Token: SeSystemProfilePrivilege 1408 taskmgr.exe Token: SeCreateGlobalPrivilege 1408 taskmgr.exe Token: 33 1408 taskmgr.exe Token: SeIncBasePriorityPrivilege 1408 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe 1408 taskmgr.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2080 2356 Setup.exe 103 PID 2356 wrote to memory of 2080 2356 Setup.exe 103 PID 2356 wrote to memory of 2080 2356 Setup.exe 103 PID 2356 wrote to memory of 2080 2356 Setup.exe 103 PID 2356 wrote to memory of 2080 2356 Setup.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"2⤵PID:2080
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1408