Analysis
-
max time kernel
85s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
putin.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
putin.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral3
Sample
putin.exe
Resource
win11-20240426-en
windows11-21h2-x64
5 signatures
300 seconds
General
-
Target
putin.exe
-
Size
1.3MB
-
MD5
1181b60d1b2f613141858e09f5baed74
-
SHA1
c1ad5d6e20153c60310059110d2981c5551f32f5
-
SHA256
a54871a86ea0ab334357133661e3e5b36e8b03e91f6037639315e109499339a7
-
SHA512
1aec1047cd576325e2ceb62e98a1e1349e3cf2fdd2393cb22f36af253f66df426fbf94e697e43d4ddcff1d2f6be1c930c18632c4ebdb5c9f312879a451250117
-
SSDEEP
24576:ZXeNLwOs5l6z5vsVq3OnxTHZscDtY2t43QeUFZP7VgK:VeQlmsV/dlDFXeUFB7VL
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4196 taskmgr.exe Token: SeSystemProfilePrivilege 4196 taskmgr.exe Token: SeCreateGlobalPrivilege 4196 taskmgr.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe -
Suspicious use of SendNotifyMessage 58 IoCs
pid Process 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe 4196 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\putin.exe"C:\Users\Admin\AppData\Local\Temp\putin.exe"1⤵PID:1516
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4196