Analysis
-
max time kernel
34s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Hydra.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Hydra.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
Hydra.exe
-
Size
43KB
-
MD5
b2eca909a91e1946457a0b36eaf90930
-
SHA1
3200c4e4d0d4ece2b2aadb6939be59b91954bcfa
-
SHA256
0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
-
SHA512
607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf
-
SSDEEP
768:1uy2FRMytCquuhuVWHzeYDroQXI2zeYDriexi:N6HeQXI1exi
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4820 taskmgr.exe Token: SeSystemProfilePrivilege 4820 taskmgr.exe Token: SeCreateGlobalPrivilege 4820 taskmgr.exe Token: 33 4820 taskmgr.exe Token: SeIncBasePriorityPrivilege 4820 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe 4820 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hydra.exe"C:\Users\Admin\AppData\Local\Temp\Hydra.exe"1⤵PID:1944
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4820