Analysis
-
max time kernel
531s -
max time network
422s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 15:13
Behavioral task
behavioral1
Sample
File.exe.zip
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
File.exe.zip
Resource
win10v2004-20240508-en
General
-
Target
File.exe.zip
-
Size
6.5MB
-
MD5
ec2fc61bb39bf11c5e81177b5be7d77b
-
SHA1
d5fe4286c618fb75729928109b43982b10552b36
-
SHA256
0f567b317592e4b0738e342d40d37f3ea6ff1c856fbc8ce64f74cb4d33016707
-
SHA512
2eef69529df2d2997a0348040f0b84ecd1d7489f4410138e42dbed08632158453493fdefe43959f3ae48e6af18ca77bde9093ae5b5e9580461a33aaffa804c92
-
SSDEEP
196608:p4eG8Sp8m8ZLxQFS8CcqWstCF1QcSGGl7Hzty+OMN:p4eG6xWIwsQDvPGlvtypMN
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Processes:
resource yara_rule behavioral2/memory/1636-17-0x00007FF6DE3E0000-0x00007FF6DF0D3000-memory.dmp vmprotect -
Drops file in System32 directory 4 IoCs
Processes:
File.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy File.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini File.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol File.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI File.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exeFile.exepid process 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 1636 File.exe 1636 File.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 4444 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 4444 taskmgr.exe Token: SeSystemProfilePrivilege 4444 taskmgr.exe Token: SeCreateGlobalPrivilege 4444 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe 4444 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
File.exepid process 1636 File.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\File.exe.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\File.exe"C:\Users\Admin\Desktop\File.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\File.exe.zipFilesize
6.5MB
MD5ec2fc61bb39bf11c5e81177b5be7d77b
SHA1d5fe4286c618fb75729928109b43982b10552b36
SHA2560f567b317592e4b0738e342d40d37f3ea6ff1c856fbc8ce64f74cb4d33016707
SHA5122eef69529df2d2997a0348040f0b84ecd1d7489f4410138e42dbed08632158453493fdefe43959f3ae48e6af18ca77bde9093ae5b5e9580461a33aaffa804c92
-
memory/1636-17-0x00007FF6DE3E0000-0x00007FF6DF0D3000-memory.dmpFilesize
12.9MB
-
memory/1636-14-0x00007FFB042D0000-0x00007FFB042D2000-memory.dmpFilesize
8KB
-
memory/4444-12-0x0000022ADC5E0000-0x0000022ADC5E1000-memory.dmpFilesize
4KB
-
memory/4444-8-0x0000022ADC5E0000-0x0000022ADC5E1000-memory.dmpFilesize
4KB
-
memory/4444-13-0x0000022ADC5E0000-0x0000022ADC5E1000-memory.dmpFilesize
4KB
-
memory/4444-3-0x0000022ADC5E0000-0x0000022ADC5E1000-memory.dmpFilesize
4KB
-
memory/4444-11-0x0000022ADC5E0000-0x0000022ADC5E1000-memory.dmpFilesize
4KB
-
memory/4444-10-0x0000022ADC5E0000-0x0000022ADC5E1000-memory.dmpFilesize
4KB
-
memory/4444-9-0x0000022ADC5E0000-0x0000022ADC5E1000-memory.dmpFilesize
4KB
-
memory/4444-7-0x0000022ADC5E0000-0x0000022ADC5E1000-memory.dmpFilesize
4KB
-
memory/4444-2-0x0000022ADC5E0000-0x0000022ADC5E1000-memory.dmpFilesize
4KB
-
memory/4444-1-0x0000022ADC5E0000-0x0000022ADC5E1000-memory.dmpFilesize
4KB