Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
24/05/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
Vývoz EXS CZ44962878_S&K LABEL SPOL. S.R.O.+24CZ5300000A8WG7C2+4656000.xml.zip
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
EXS CZ44962878_S&K LABEL SPOL. S.R.O.+24CZ5300000A8WG7C2+4656000.pdf
Resource
win11-20240508-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
EXS CZ44962878_S&K LABEL SPOL. S.R.O.+24CZ5300000A8WG7C2+4656000.xml
Resource
win11-20240426-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
EXS CZ44962878_S&K LABEL SPOL. S.R.O.+24CZ5300000A8WG7C2+4656000.xml
-
Size
13KB
-
MD5
6abefe21eb45c29547060e4d0b79f503
-
SHA1
1e0d23fb244d977ec6ea99eaeff09b79910e5fb6
-
SHA256
f2b750246ee28a84c4bbc0fbcf78f921f0529b2cff03ef614b02820ff62adb66
-
SHA512
de0f250eeedb682e7fd00a7680cea0dacf73f257b0197989f7ceb9c27fe9f9781343191997f1e96b0cb260223d8770c0a1ed85f6a6fe4015d5264f896f00a4c9
-
SSDEEP
384:nj/loOTbV/6CZqa5a74JzAfxZa9OFic48ewVoo0YwKRlSaiK:j/loOHqa5p+pZa9U48ewVoo0YwKRlSav
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31108600" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "565115171" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4464 taskmgr.exe Token: SeSystemProfilePrivilege 4464 taskmgr.exe Token: SeCreateGlobalPrivilege 4464 taskmgr.exe Token: 33 4464 taskmgr.exe Token: SeIncBasePriorityPrivilege 4464 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe 4464 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2740 wrote to memory of 816 2740 MSOXMLED.EXE 80 PID 2740 wrote to memory of 816 2740 MSOXMLED.EXE 80
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\EXS CZ44962878_S&K LABEL SPOL. S.R.O.+24CZ5300000A8WG7C2+4656000.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\EXS CZ44962878_S&K LABEL SPOL. S.R.O.+24CZ5300000A8WG7C2+4656000.xml2⤵
- Modifies Internet Explorer settings
PID:816
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:2816
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4464