Analysis
-
max time kernel
118s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 20:14
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
300 seconds
General
-
Target
Server.exe
-
Size
1.3MB
-
MD5
dd6667db55acaefa2d7e99dcf5d97a26
-
SHA1
c1b281ef573df4da584294c61b5322edfed589ad
-
SHA256
ce8fd5ec0b2ee4e5d87d35622eeaa022ee971801c97bcb3726ca6ebe4b576238
-
SHA512
916c8b63400c0a8e495fc59d8e348499a6f04421e79599803c7ac4cd828c82f389bfd733471de27cc1643c03723429f8544446d9adc69082e6a5032139a1f1f1
-
SSDEEP
24576:RIVMEFyWLoQJV+fLmomlEkmmsEnE7E7E7EUmemmmmmmIDmeIjwnaKk:RWMEMWlVILmomSkmmtEQQQUmemmmmmm7
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\taskschd.msc mmc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3304 2228 WerFault.exe 83 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3048 mmc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3684 taskmgr.exe Token: SeSystemProfilePrivilege 3684 taskmgr.exe Token: SeCreateGlobalPrivilege 3684 taskmgr.exe Token: 33 3684 taskmgr.exe Token: SeIncBasePriorityPrivilege 3684 taskmgr.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe Token: SeIncBasePriorityPrivilege 3048 mmc.exe Token: 33 3048 mmc.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
pid Process 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe 3684 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3048 mmc.exe 3048 mmc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵PID:2228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 8242⤵
- Program crash
PID:3304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2228 -ip 22281⤵PID:4372
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3684
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3048