Analysis
-
max time kernel
36s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
atiagentCozyBear.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
atiagentCozyBear.dll
-
Size
52KB
-
MD5
452ee2968ec82c7e30c21c828b330c17
-
SHA1
00384c359e2931fb922b034fca2707e1b2a25396
-
SHA256
43cd9ef6904c35c6854bf59d99731a05048af9e870261064a255db0181930fad
-
SHA512
bef788d69d8d75579cbf6499b4c2aec7c413cc56fea2a51efc4dc7742f52648fff3b64b78b3d8544d81ee473472521d352f931b56564a88031c5116444b65926
-
SSDEEP
768:5mXbwhMxIYGvy6uqgFuO4IGL1VjOfTaEG9hH36PDMOKqBR4kkJmnjEDXbTvG:uOWIYG66xO4TLHOGjHqhf4kJ9
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3664 taskmgr.exe Token: SeSystemProfilePrivilege 3664 taskmgr.exe Token: SeCreateGlobalPrivilege 3664 taskmgr.exe Token: 33 3664 taskmgr.exe Token: SeIncBasePriorityPrivilege 3664 taskmgr.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe 3664 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2704 wrote to memory of 224 2704 regsvr32.exe 91 PID 2704 wrote to memory of 224 2704 regsvr32.exe 91 PID 2704 wrote to memory of 224 2704 regsvr32.exe 91
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\atiagentCozyBear.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\atiagentCozyBear.dll2⤵PID:224
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3664