Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2024 18:35
Behavioral task
behavioral1
Sample
PandziakWyszukiwarka.exe
Resource
win10-20240221-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
PandziakWyszukiwarka.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
PandziakWyszukiwarka.exe
-
Size
227KB
-
MD5
778297c513db9d797b7248d086df9961
-
SHA1
b1ab5453c0821d49a7e1769bd9c9d728536efd85
-
SHA256
fac617bf9c4e4640025850beac879d857fd29365b98843c0a33dc2a7ead77a14
-
SHA512
116f43b70a2400ef281f6f8e5ab129a6622eaac945d8fc4a4e765d1cb6b0cfd532d2807e5b496921b36f1692f43e32d3e7d607f4f9e31b7fac787e3aa56d7be7
-
SSDEEP
6144:eloZM+rIkd8g+EtXHkv/iD4u2gBGELnsld42X3Wz9hb8e1m+pi:IoZtL+EP8u2gBGELnsld42X3WDa
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3436-0-0x0000016B66270000-0x0000016B662B0000-memory.dmp family_umbral -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4840 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 3436 PandziakWyszukiwarka.exe Token: SeIncreaseQuotaPrivilege 3960 wmic.exe Token: SeSecurityPrivilege 3960 wmic.exe Token: SeTakeOwnershipPrivilege 3960 wmic.exe Token: SeLoadDriverPrivilege 3960 wmic.exe Token: SeSystemProfilePrivilege 3960 wmic.exe Token: SeSystemtimePrivilege 3960 wmic.exe Token: SeProfSingleProcessPrivilege 3960 wmic.exe Token: SeIncBasePriorityPrivilege 3960 wmic.exe Token: SeCreatePagefilePrivilege 3960 wmic.exe Token: SeBackupPrivilege 3960 wmic.exe Token: SeRestorePrivilege 3960 wmic.exe Token: SeShutdownPrivilege 3960 wmic.exe Token: SeDebugPrivilege 3960 wmic.exe Token: SeSystemEnvironmentPrivilege 3960 wmic.exe Token: SeRemoteShutdownPrivilege 3960 wmic.exe Token: SeUndockPrivilege 3960 wmic.exe Token: SeManageVolumePrivilege 3960 wmic.exe Token: 33 3960 wmic.exe Token: 34 3960 wmic.exe Token: 35 3960 wmic.exe Token: 36 3960 wmic.exe Token: SeIncreaseQuotaPrivilege 3960 wmic.exe Token: SeSecurityPrivilege 3960 wmic.exe Token: SeTakeOwnershipPrivilege 3960 wmic.exe Token: SeLoadDriverPrivilege 3960 wmic.exe Token: SeSystemProfilePrivilege 3960 wmic.exe Token: SeSystemtimePrivilege 3960 wmic.exe Token: SeProfSingleProcessPrivilege 3960 wmic.exe Token: SeIncBasePriorityPrivilege 3960 wmic.exe Token: SeCreatePagefilePrivilege 3960 wmic.exe Token: SeBackupPrivilege 3960 wmic.exe Token: SeRestorePrivilege 3960 wmic.exe Token: SeShutdownPrivilege 3960 wmic.exe Token: SeDebugPrivilege 3960 wmic.exe Token: SeSystemEnvironmentPrivilege 3960 wmic.exe Token: SeRemoteShutdownPrivilege 3960 wmic.exe Token: SeUndockPrivilege 3960 wmic.exe Token: SeManageVolumePrivilege 3960 wmic.exe Token: 33 3960 wmic.exe Token: 34 3960 wmic.exe Token: 35 3960 wmic.exe Token: 36 3960 wmic.exe Token: SeDebugPrivilege 4840 taskmgr.exe Token: SeSystemProfilePrivilege 4840 taskmgr.exe Token: SeCreateGlobalPrivilege 4840 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3436 wrote to memory of 3960 3436 PandziakWyszukiwarka.exe 83 PID 3436 wrote to memory of 3960 3436 PandziakWyszukiwarka.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\PandziakWyszukiwarka.exe"C:\Users\Admin\AppData\Local\Temp\PandziakWyszukiwarka.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4840