Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 13:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Pepsi Nova.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Pepsi Nova.exe
-
Size
24KB
-
MD5
1144018abd6127edd733b90871c752f1
-
SHA1
57d094917420528b9e816cc8dbc69ab28b915644
-
SHA256
7a40a203108bc4afb664f904a98ae48832ad4b2cfc7b654d8e65595d896a2cd8
-
SHA512
ec3de323d7df331dc6718b3b9c960bcb1df059ffb0aea59c2a958537b3399f79ee1a36c50f9add659bcc580a03ac9cc31f5afdd1e32f11ebba3256b08d2a633f
-
SSDEEP
384:s6KDFHelj4SsoNMuE1XFqPq+7BqIYd3qDapodfB353Qvrrz7nXht:Uh0srZ1XFy7BqIYd3qhdfB35g/z7
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\n0tepad.exe Pepsi Nova.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2008 taskmgr.exe Token: SeSystemProfilePrivilege 2008 taskmgr.exe Token: SeCreateGlobalPrivilege 2008 taskmgr.exe Token: 33 2008 taskmgr.exe Token: SeIncBasePriorityPrivilege 2008 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe 2008 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pepsi Nova.exe"C:\Users\Admin\AppData\Local\Temp\Pepsi Nova.exe"1⤵
- Drops file in System32 directory
PID:5056
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2008
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:81⤵PID:984
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2224
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵PID:4440
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵PID:4584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.2MB
MD5f6d8913637f1d5d2dc846de70ce02dc5
SHA15fc9c6ab334db1f875fbc59a03f5506c478c6c3e
SHA2564e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187
SHA51221217a0a0eca58fc6058101aa69cf30d5dbe419c21fa7a160f44d8ebbcf5f4011203542c8f400a9bb8ee3826706417f2939c402f605817df597b7ff812b43036