Analysis
-
max time kernel
149s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 14:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Hwid Checker.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Hwid Checker.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Hwid Checker.exe
-
Size
90KB
-
MD5
2504ff93b1398134958c996b1f31d35d
-
SHA1
a803f865f6f80206273c67731701ac090c936940
-
SHA256
d14cf0df3829a005c3270ef79def0f4b5ad8114a53c3dd70dcb8f27745f829c2
-
SHA512
e5aa6a9aaea44622acae795fd81447deaa1b62772f89d890e1bb2e04837e03e4a22d8e3cb554a72c96d05f4bd81c5f094cd465201192b3dacb80e8a0d274fc62
-
SSDEEP
1536:v7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfswgOa:D7DhdC6kzWypvaQ0FxyNTBfsr
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2936 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3460 WMIC.exe Token: SeSecurityPrivilege 3460 WMIC.exe Token: SeTakeOwnershipPrivilege 3460 WMIC.exe Token: SeLoadDriverPrivilege 3460 WMIC.exe Token: SeSystemProfilePrivilege 3460 WMIC.exe Token: SeSystemtimePrivilege 3460 WMIC.exe Token: SeProfSingleProcessPrivilege 3460 WMIC.exe Token: SeIncBasePriorityPrivilege 3460 WMIC.exe Token: SeCreatePagefilePrivilege 3460 WMIC.exe Token: SeBackupPrivilege 3460 WMIC.exe Token: SeRestorePrivilege 3460 WMIC.exe Token: SeShutdownPrivilege 3460 WMIC.exe Token: SeDebugPrivilege 3460 WMIC.exe Token: SeSystemEnvironmentPrivilege 3460 WMIC.exe Token: SeRemoteShutdownPrivilege 3460 WMIC.exe Token: SeUndockPrivilege 3460 WMIC.exe Token: SeManageVolumePrivilege 3460 WMIC.exe Token: 33 3460 WMIC.exe Token: 34 3460 WMIC.exe Token: 35 3460 WMIC.exe Token: 36 3460 WMIC.exe Token: SeIncreaseQuotaPrivilege 3460 WMIC.exe Token: SeSecurityPrivilege 3460 WMIC.exe Token: SeTakeOwnershipPrivilege 3460 WMIC.exe Token: SeLoadDriverPrivilege 3460 WMIC.exe Token: SeSystemProfilePrivilege 3460 WMIC.exe Token: SeSystemtimePrivilege 3460 WMIC.exe Token: SeProfSingleProcessPrivilege 3460 WMIC.exe Token: SeIncBasePriorityPrivilege 3460 WMIC.exe Token: SeCreatePagefilePrivilege 3460 WMIC.exe Token: SeBackupPrivilege 3460 WMIC.exe Token: SeRestorePrivilege 3460 WMIC.exe Token: SeShutdownPrivilege 3460 WMIC.exe Token: SeDebugPrivilege 3460 WMIC.exe Token: SeSystemEnvironmentPrivilege 3460 WMIC.exe Token: SeRemoteShutdownPrivilege 3460 WMIC.exe Token: SeUndockPrivilege 3460 WMIC.exe Token: SeManageVolumePrivilege 3460 WMIC.exe Token: 33 3460 WMIC.exe Token: 34 3460 WMIC.exe Token: 35 3460 WMIC.exe Token: 36 3460 WMIC.exe Token: SeIncreaseQuotaPrivilege 1740 WMIC.exe Token: SeSecurityPrivilege 1740 WMIC.exe Token: SeTakeOwnershipPrivilege 1740 WMIC.exe Token: SeLoadDriverPrivilege 1740 WMIC.exe Token: SeSystemProfilePrivilege 1740 WMIC.exe Token: SeSystemtimePrivilege 1740 WMIC.exe Token: SeProfSingleProcessPrivilege 1740 WMIC.exe Token: SeIncBasePriorityPrivilege 1740 WMIC.exe Token: SeCreatePagefilePrivilege 1740 WMIC.exe Token: SeBackupPrivilege 1740 WMIC.exe Token: SeRestorePrivilege 1740 WMIC.exe Token: SeShutdownPrivilege 1740 WMIC.exe Token: SeDebugPrivilege 1740 WMIC.exe Token: SeSystemEnvironmentPrivilege 1740 WMIC.exe Token: SeRemoteShutdownPrivilege 1740 WMIC.exe Token: SeUndockPrivilege 1740 WMIC.exe Token: SeManageVolumePrivilege 1740 WMIC.exe Token: 33 1740 WMIC.exe Token: 34 1740 WMIC.exe Token: 35 1740 WMIC.exe Token: 36 1740 WMIC.exe Token: SeIncreaseQuotaPrivilege 1740 WMIC.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe 2936 taskmgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4544 wrote to memory of 4872 4544 Hwid Checker.exe 87 PID 4544 wrote to memory of 4872 4544 Hwid Checker.exe 87 PID 4872 wrote to memory of 3460 4872 cmd.exe 88 PID 4872 wrote to memory of 3460 4872 cmd.exe 88 PID 4872 wrote to memory of 1740 4872 cmd.exe 90 PID 4872 wrote to memory of 1740 4872 cmd.exe 90 PID 4872 wrote to memory of 3368 4872 cmd.exe 91 PID 4872 wrote to memory of 3368 4872 cmd.exe 91 PID 4872 wrote to memory of 4912 4872 cmd.exe 92 PID 4872 wrote to memory of 4912 4872 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hwid Checker.exe"C:\Users\Admin\AppData\Local\Temp\Hwid Checker.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2FCA.tmp\2FCB.tmp\2FCC.bat "C:\Users\Admin\AppData\Local\Temp\Hwid Checker.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid3⤵PID:3368
-
-
C:\Windows\system32\getmac.exegetmac3⤵PID:4912
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539B
MD58196f772d992703d45de9b2820381da0
SHA1f28f3745fdeb961f91546db4053c8386dd2533ad
SHA256171136fd6cb1bfbdecb02f221c84e8591dfec16c4031d9b78ad577313146d3dd
SHA5128e6a0ce60f4c81e00ff12f9175202b2bb460f20875a6098bef6cc03d54d15b93e1f51a23bda408a80f67a32bff631a2af7b1a5e14357e72422ca9c1c178f453b