Analysis
-
max time kernel
150s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 05:26
Static task
static1
Behavioral task
behavioral1
Sample
AppVIsvSubsystems64.dll
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
AppVIsvSubsystems64.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
AppVLP.exe
Resource
win10v2004-20231215-en
General
-
Target
AppVIsvSubsystems64.dll
-
Size
1.1MB
-
MD5
0c60e150bc32545fd2837cf5280398af
-
SHA1
9edec80cd4d22727431778795fc94fcdd02af889
-
SHA256
c5ca89b5bbf4d19079dce1954c245bb5cc2b3bd63f98ddc23f1329365ef4dd06
-
SHA512
955e5a64e85afe17e0909fe466e11d31b284d27029b5c2a4ae619b3beb7a392ac4040c8fbaf67e840409f9c81a57033a7ce6a257624d9e2bf894cffd380ee5ab
-
SSDEEP
24576:ik7fYerH7nmpWvZahM6iAmZvJRrTgkn242MWUWU4hh6hRJmc:pfYeXmQvZahIQ69V1NUc
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
taskmgr.exepid process 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 4712 taskmgr.exe Token: SeSystemProfilePrivilege 4712 taskmgr.exe Token: SeCreateGlobalPrivilege 4712 taskmgr.exe Token: 33 4712 taskmgr.exe Token: SeIncBasePriorityPrivilege 4712 taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
Processes:
taskmgr.exepid process 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
Processes:
taskmgr.exepid process 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\AppVIsvSubsystems64.dll,#11⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4712-0-0x00000286C39A0000-0x00000286C39A1000-memory.dmpFilesize
4KB
-
memory/4712-1-0x00000286C39A0000-0x00000286C39A1000-memory.dmpFilesize
4KB
-
memory/4712-2-0x00000286C39A0000-0x00000286C39A1000-memory.dmpFilesize
4KB
-
memory/4712-7-0x00000286C39A0000-0x00000286C39A1000-memory.dmpFilesize
4KB
-
memory/4712-6-0x00000286C39A0000-0x00000286C39A1000-memory.dmpFilesize
4KB
-
memory/4712-8-0x00000286C39A0000-0x00000286C39A1000-memory.dmpFilesize
4KB
-
memory/4712-9-0x00000286C39A0000-0x00000286C39A1000-memory.dmpFilesize
4KB
-
memory/4712-10-0x00000286C39A0000-0x00000286C39A1000-memory.dmpFilesize
4KB
-
memory/4712-11-0x00000286C39A0000-0x00000286C39A1000-memory.dmpFilesize
4KB
-
memory/4712-12-0x00000286C39A0000-0x00000286C39A1000-memory.dmpFilesize
4KB