Analysis
-
max time kernel
93s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 21:31
Static task
static1
Behavioral task
behavioral1
Sample
42.zip
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
42.zip
-
Size
41KB
-
MD5
1df9a18b18332f153918030b7b516615
-
SHA1
6c42c62696616b72bbfc88a4be4ead57aa7bc503
-
SHA256
bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
-
SHA512
6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
-
SSDEEP
768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4008 vlc.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4008 vlc.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3584 taskmgr.exe Token: SeSystemProfilePrivilege 3584 taskmgr.exe Token: SeCreateGlobalPrivilege 3584 taskmgr.exe Token: 33 3584 taskmgr.exe Token: SeIncBasePriorityPrivilege 3584 taskmgr.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 3584 taskmgr.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe 4008 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4008 vlc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 804 wrote to memory of 1812 804 cmd.exe 103 PID 804 wrote to memory of 1812 804 cmd.exe 103
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\42.zip1⤵PID:832
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4456
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3584
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\system32\format.comformat c:2⤵PID:1812
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CompareRepair.mov"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4008