Analysis
-
max time kernel
228s -
max time network
306s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 19:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
650f5a3b-a-0b-b.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
300 seconds
General
-
Target
650f5a3b-a-0b-b.exe
-
Size
4.3MB
-
MD5
91384d0f4d77e075d4e1c25bccb2f304
-
SHA1
d0bbb8038eef845d41010baf7444bd7d4435745e
-
SHA256
2c91b4800285e2b210e9720d135cdeceaca65643d70238b543379f1c9a781c60
-
SHA512
5cc0c98839ab125f2ae07cd26e9c15069144c91b44560400f19646edde6d22748875f1df8c0dea9fc74a7affdf3b31ee275b86be0656fafd1669b8d5abf4619a
-
SSDEEP
49152:EvA1wdjU88sfiZGJZQqaqfH90PxUM9gx1HnPQ6X++1HWSEHfnqocbyNC8IlXA:EqAxNe+niSMQ9n
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3288 set thread context of 3048 3288 650f5a3b-a-0b-b.exe 107 PID 4664 set thread context of 1272 4664 650f5a3b-a-0b-b.exe 106 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3728 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3728 taskmgr.exe Token: SeSystemProfilePrivilege 3728 taskmgr.exe Token: SeCreateGlobalPrivilege 3728 taskmgr.exe Token: SeDebugPrivilege 4664 650f5a3b-a-0b-b.exe Token: SeDebugPrivilege 3288 650f5a3b-a-0b-b.exe Token: 33 3728 taskmgr.exe Token: SeIncBasePriorityPrivilege 3728 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe 3728 taskmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4664 wrote to memory of 1272 4664 650f5a3b-a-0b-b.exe 106 PID 4664 wrote to memory of 1272 4664 650f5a3b-a-0b-b.exe 106 PID 4664 wrote to memory of 1272 4664 650f5a3b-a-0b-b.exe 106 PID 3288 wrote to memory of 3048 3288 650f5a3b-a-0b-b.exe 107 PID 3288 wrote to memory of 3048 3288 650f5a3b-a-0b-b.exe 107 PID 3288 wrote to memory of 3048 3288 650f5a3b-a-0b-b.exe 107 PID 4664 wrote to memory of 1272 4664 650f5a3b-a-0b-b.exe 106 PID 3288 wrote to memory of 3048 3288 650f5a3b-a-0b-b.exe 107 PID 3288 wrote to memory of 3048 3288 650f5a3b-a-0b-b.exe 107 PID 4664 wrote to memory of 1272 4664 650f5a3b-a-0b-b.exe 106 PID 3288 wrote to memory of 3048 3288 650f5a3b-a-0b-b.exe 107 PID 3288 wrote to memory of 3048 3288 650f5a3b-a-0b-b.exe 107 PID 4664 wrote to memory of 1272 4664 650f5a3b-a-0b-b.exe 106 PID 4664 wrote to memory of 1272 4664 650f5a3b-a-0b-b.exe 106 PID 3288 wrote to memory of 3048 3288 650f5a3b-a-0b-b.exe 107 PID 4664 wrote to memory of 1272 4664 650f5a3b-a-0b-b.exe 106
Processes
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3728
-
C:\Users\Admin\AppData\Local\Temp\650f5a3b-a-0b-b.exe"C:\Users\Admin\AppData\Local\Temp\650f5a3b-a-0b-b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"2⤵PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:2108
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\650f5a3b-a-0b-b.exe"C:\Users\Admin\AppData\Local\Temp\650f5a3b-a-0b-b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"2⤵PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
847B
MD5f8ec7f563d06ccddddf6c96b8957e5c8
SHA173bdc49dcead32f8c29168645a0f080084132252
SHA25638ef57aec780edd2c8dab614a85ce87351188fce5896ffebc9f69328df2056ed
SHA5128830821ac9edb4cdf4d8a3d7bc30433987ae4c158cf81b705654f54aaeba366c5fa3509981aceae21e193dd4483f03b9d449bc0a32545927d3ca94b0f9367684