Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 10:12
Static task
static1
Behavioral task
behavioral1
Sample
Guna.UI.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Guna.UI2.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
MaddStress.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
General
-
Target
MaddStress.exe
-
Size
294KB
-
MD5
acd99287b8b4b7fffe593bb90a2496f5
-
SHA1
16c63c1f1cddec362355c7657aa3b7b8817f5972
-
SHA256
07d774984471629b80bd093794d3de79e0b26c2ac81765e56b8b9fc4ec76d532
-
SHA512
0c561d4f8d62c0502ea0177b9c621129a4fb056a14de0d9fca0526389ed46259dc5aa400fa9172f26df8428107005ee507dd0a683f60c0fddc87e1714826057f
-
SSDEEP
3072:ina50wvLAA2Hd2/U98uCarsim/ttmOq3UpKx7mdSSQJDd8ZmnmNQPrY/gAFB3cF1:PAiXQNd8cmbwpkni5Hq
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MaddStress.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MaddStress.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 3320 MaddStress.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3320 MaddStress.exe Token: SeDebugPrivilege 4964 taskmgr.exe Token: SeSystemProfilePrivilege 4964 taskmgr.exe Token: SeCreateGlobalPrivilege 4964 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MaddStress.exe"C:\Users\Admin\AppData\Local\Temp\MaddStress.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1724
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_Url_m54fpvtmfkxlt4ulvef2d5cxirc15btn\0.0.4.0\user.config
Filesize1KB
MD5c6dc00f74ab0acf4841a41e5696477d2
SHA1cd2cee8c267f5d909d3e249301993b4286d1acfd
SHA256bc8d2f6e92087bcf2008d2ba7f760e8cce1396b206cbca3022e495f976017dbd
SHA512a27e08e7b7582724f4ee351441177f33dc7f84672fad788ce9f7e21ea784ecf48e8cc7e8e6a5bdf638b7bbc65b131968df347040463bd8776f1bbc4176e40fd5
-
C:\Users\Admin\AppData\Local\DrWeabo_Inc\MaddStress.exe_Url_m54fpvtmfkxlt4ulvef2d5cxirc15btn\0.0.4.0\user.config
Filesize2KB
MD5ddcc161f19fdb411fae1629fad08a2df
SHA1eacbe2ff6c2848bea403ab45f0bf48548f84a25a
SHA256cc4316ca6ac9532b68adde61ecc631691531e4216f9e4981dfdf47ad94d99d2e
SHA5122325926b8d211127c034079bf93a503e447b185814186d0c9393d26a9d870062e628bb0740cea9c35ecbbf46acebb9e50c9ae8fe5cebb569be6286b613ef8988