Analysis
-
max time kernel
147s -
max time network
129s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
12-05-2024 03:20
Behavioral task
behavioral1
Sample
PatchGadar.exe
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
PatchGadar.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral3
Sample
PatchGadar.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
1800 seconds
General
-
Target
PatchGadar.exe
-
Size
293KB
-
MD5
edcfedc1c217b5907f6b69272e5ca98f
-
SHA1
e4bb7f3226e809c7ad1e12193ee26048cfc58790
-
SHA256
114ad98c82f045d81f4b456900e650ea316e7dda7a1d8c5396e585488986d6fe
-
SHA512
c1a9d970e7690f60eb1ad0ea85a57c942b31006db8dbbfcc46e1d0e1036ee2957f67ce205eba93b426d78dd6eb8bcf23fb713b3442ae1ab91f59a24ed6e4e626
-
SSDEEP
3072:e3MK0Jc5YQoIpwg9iO2OaiS40eBwYG3zRrYp2OplMGc8A6uHPMG7CUqkZFI0CADL:u2c5YQoI2gzai9kjJkhpuJvYuH
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral4/memory/1376-1-0x0000000000E70000-0x0000000000EC0000-memory.dmp family_zgrat_v1 -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral4/memory/1376-1-0x0000000000E70000-0x0000000000EC0000-memory.dmp net_reactor -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4760 Taskmgr.exe Token: SeSystemProfilePrivilege 4760 Taskmgr.exe Token: SeCreateGlobalPrivilege 4760 Taskmgr.exe Token: 33 4760 Taskmgr.exe Token: SeIncBasePriorityPrivilege 4760 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe 4760 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 888 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PatchGadar.exe"C:\Users\Admin\AppData\Local\Temp\PatchGadar.exe"1⤵PID:1376
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:888
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4760
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4932
-
C:\Windows\System32\pbpbks.exe"C:\Windows\System32\pbpbks.exe"1⤵PID:4736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5394f971f95da279c2ebf1a4113ce8426
SHA174f73a16920c5919ccb7788e3c2429c291da34d3
SHA2565555d03ce11acdeae26b199b7bdf7220be2f8a4668800c29644740857576659f
SHA5121ea93d43096e70a182b4a5011b20b2a0c3558b907039c8ead7c3f89cc360b8ee635789b15398ef42f6a0c74a98d9f070290d5e98f786017e4d6bc3e25a042f33