Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 10:24
Behavioral task
behavioral1
Sample
v7.09/Bg7dhrk4g6.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
v7.09/Bg7dhrk4g6.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
v7.09/Bg7dhrk4g6.exe
-
Size
1.9MB
-
MD5
0b2464f44dbdcc01b5730bed1d9ffe4e
-
SHA1
2e23e5aae8d04177c35e56f0f052dc0b8e551f6e
-
SHA256
59639335a0f8b9412aad0bbefe3359f868b73a7b017533ee5143cfecc3a38ce8
-
SHA512
3216577f5dcde75e0632c35bd1627dfd7e544de7b0d78a1fe0cd2dac2dfc2a04d8d0aeeea07d79f8b4f4654e33b605d9194c8881a7d9bd4f02f6406c67d93c6c
-
SSDEEP
49152:EfG+scJgEGhGeStYrP3itZHgNGx5orK4mzA:/HBhGPtYP3iHIeqm4m
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1060 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1060 taskmgr.exe Token: SeSystemProfilePrivilege 1060 taskmgr.exe Token: SeCreateGlobalPrivilege 1060 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe 1060 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1288 wrote to memory of 3900 1288 cmd.exe 107 PID 1288 wrote to memory of 3900 1288 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\v7.09\Bg7dhrk4g6.exe"C:\Users\Admin\AppData\Local\Temp\v7.09\Bg7dhrk4g6.exe"1⤵PID:3040
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1060
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1676
-
C:\Windows\System32\brcg55.exe"C:\Windows\System32\brcg55.exe"1⤵PID:4360
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\System32\brcg55.exebrcg55.exe2⤵PID:3900
-
-
C:\Users\Admin\AppData\Local\Temp\v7.09\Bg7dhrk4g6.exe"C:\Users\Admin\AppData\Local\Temp\v7.09\Bg7dhrk4g6.exe"1⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\v7.09\Bg7dhrk4g6.exe"C:\Users\Admin\AppData\Local\Temp\v7.09\Bg7dhrk4g6.exe"1⤵PID:1824