Analysis
-
max time kernel
41s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 20:04
Static task
static1
Behavioral task
behavioral1
Sample
downloader.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
downloader.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral3
Sample
downloader.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
downloader.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
downloader.exe
Resource
win11-20240412-en
windows11-21h2-x64
General
-
Target
downloader.exe
-
Size
203KB
-
MD5
6922e66413b832878ac33061032d610f
-
SHA1
0ec966e045149267007cd840798e7b0e0a077786
-
SHA256
c014b10df32d537cb505efaa593bee22bcb2cd63b1bcd12a7ab44c958031846f
-
SHA512
2c1ccde7c9bd793f40c3a0c6fc94aa8b8de222ed6eca52ca7249fad79d994200bd48bb1874579984ea74eb2e52d0b7fa7636b6f93fe18a17e76842e84807280f
-
SSDEEP
3072:XWF1Sss2XaOvu+v7QC2mCAbtoJOBW0rArwrkut57cIrDjy6HyaPKbY64IrHxzMxz:XWF0+XaOvuyycWNrwrk6yabJIrRzM
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4672 taskmgr.exe Token: SeSystemProfilePrivilege 4672 taskmgr.exe Token: SeCreateGlobalPrivilege 4672 taskmgr.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe -
Suspicious use of SendNotifyMessage 42 IoCs
pid Process 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe
Processes
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4672
-
C:\Users\Admin\AppData\Local\Temp\downloader.exe"C:\Users\Admin\AppData\Local\Temp\downloader.exe"1⤵PID:4324