Analysis
-
max time kernel
136s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 13:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7z.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
7z.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
TORONTO.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
TORONTO.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
opengl32sw.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
opengl32sw.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
opengl32sw.dll
-
Size
20.0MB
-
MD5
7dbc97bfee0c7ac89da8d0c770c977b6
-
SHA1
a064c8d8967aaa4ada29bd9fefbe40405360412c
-
SHA256
963641a718f9cae2705d5299eae9b7444e84e72ab3bef96a691510dd05fa1da4
-
SHA512
286997501e1f5ce236c041dcb1a225b4e01c0f7c523c18e9835507a15c0ac53c4d50f74f94822125a7851fe2cb2fb72f84311a2259a5a50dce6f56ba05d1d7e8
-
SSDEEP
393216:LIckHor5uLnn83wAP5hxOZEa7/LzRuDFqILn5LgcKyZyQXt+8M:yEZbv
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1732 rundll32.exe 1732 rundll32.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4252 taskmgr.exe Token: SeSystemProfilePrivilege 4252 taskmgr.exe Token: SeCreateGlobalPrivilege 4252 taskmgr.exe Token: 33 4252 taskmgr.exe Token: SeIncBasePriorityPrivilege 4252 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe -
Suspicious use of SendNotifyMessage 41 IoCs
pid Process 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe 4252 taskmgr.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\opengl32sw.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1732
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4252
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:808