Analysis
-
max time kernel
123s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-04-2024 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fn-curl.exe
Resource
win11-20240426-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
fn-curl.exe
-
Size
191KB
-
MD5
13e5edffc2165407dc40a80b43460d84
-
SHA1
87ffa041cb77ae10f44c65a6499a3c5285ec7e49
-
SHA256
3a935bdbd8ab07b1717747ee324100da210f09290fa335eca7006b89019d3abc
-
SHA512
0a47001813ad667263bcab43b90a7bdfe29c42b8741995b5d40db83e9273aa933670812b307687060e215b8de1d59c52d9b58f00b181dcff2f5ad48a25f31609
-
SSDEEP
3072:lsZwZeLxvFUkkqy6YX72F54JrCI64G/D55w1by3YV8E6:qZwZe74AxjobJ
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings Taskmgr.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2252 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3032 Taskmgr.exe Token: SeSystemProfilePrivilege 3032 Taskmgr.exe Token: SeCreateGlobalPrivilege 3032 Taskmgr.exe Token: 33 3032 Taskmgr.exe Token: SeIncBasePriorityPrivilege 3032 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe -
Suspicious use of SendNotifyMessage 58 IoCs
pid Process 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe 3032 Taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 336 wrote to memory of 3144 336 fn-curl.exe 80 PID 336 wrote to memory of 3144 336 fn-curl.exe 80 PID 4620 wrote to memory of 3032 4620 cmd.exe 96 PID 4620 wrote to memory of 3032 4620 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\fn-curl.exe"C:\Users\Admin\AppData\Local\Temp\fn-curl.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mkdir "C:\users\conspiracy\downloads\fn-curl-mainv\fn-curl-main\nigger\x64\"2⤵PID:3144
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3288
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\niggr.txt1⤵
- Opens file in notepad (likely ransom note)
PID:2252
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\niggr.txt.bat" "1⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\system32\Taskmgr.exetaskmgr2⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7B
MD5086d80648fd6c5de341d8c29558ce8e9
SHA140971f0260b787326a5e855527ffb7e32233d190
SHA256e248981dfcf7c8cc8e12999cb2f16a0c79059b6880ad7d4796083c67e35cdd4e
SHA5125587ac9f501abad3cc0f052115c941a20e503359f0b96ff14a17d4be7531d11009a44c1756f74aa9c17676250bed88a41ca71c3b1ca4f9562e459c2cdf378b26