Analysis
-
max time kernel
195s -
max time network
257s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27-04-2024 21:25
Behavioral task
behavioral1
Sample
Guna.UI2.dll
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
88 AntiVirus.exe
Resource
win10-20240404-en
General
-
Target
88 AntiVirus.exe
-
Size
451KB
-
MD5
a2e87a7c6ecd8ac0796667cc612bb61b
-
SHA1
d581ef5bc0518832b59115cd0a47b6f669ebd51c
-
SHA256
42134c7534f30a683ad5c1e1157367ced6360598a33e24b2343c2548b897c183
-
SHA512
a4c2000b5dc8eca851efedafee056487ced4210b06146d73aa50892a00e4e1c1e4185cb3037b0e3036be37bf5b48f30cb9c24fdcb30abcd1aeb140c5f5211982
-
SSDEEP
6144:hPkUwb08T2rqj7hT2rqj7hT2rqj7KMs7Xq0KELwb0:hPiSrqsrqsrqCMiXqB1
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2676-6-0x0000000005C70000-0x0000000005E84000-memory.dmp family_agenttesla -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
88 AntiVirus.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 88 AntiVirus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion 88 AntiVirus.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 88 AntiVirus.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
taskmgr.exepid process 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1772 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
88 AntiVirus.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 2676 88 AntiVirus.exe Token: SeDebugPrivilege 1772 taskmgr.exe Token: SeSystemProfilePrivilege 1772 taskmgr.exe Token: SeCreateGlobalPrivilege 1772 taskmgr.exe Token: 33 1772 taskmgr.exe Token: SeIncBasePriorityPrivilege 1772 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88 AntiVirus.exe"C:\Users\Admin\AppData\Local\Temp\88 AntiVirus.exe"1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2676-0-0x00000000006A0000-0x0000000000716000-memory.dmpFilesize
472KB
-
memory/2676-1-0x0000000073140000-0x000000007382E000-memory.dmpFilesize
6.9MB
-
memory/2676-2-0x0000000005550000-0x0000000005A4E000-memory.dmpFilesize
5.0MB
-
memory/2676-3-0x00000000050F0000-0x0000000005182000-memory.dmpFilesize
584KB
-
memory/2676-4-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/2676-5-0x00000000050C0000-0x00000000050CA000-memory.dmpFilesize
40KB
-
memory/2676-6-0x0000000005C70000-0x0000000005E84000-memory.dmpFilesize
2.1MB
-
memory/2676-7-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/2676-8-0x0000000073140000-0x000000007382E000-memory.dmpFilesize
6.9MB
-
memory/2676-9-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/2676-10-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB