Analysis
-
max time kernel
80s -
max time network
85s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 12:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ED62B6BD122.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ED62B6BD122.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ED62B6BD122.exe
-
Size
22.1MB
-
MD5
68eca888cb479f840503bcdbda3acc88
-
SHA1
609c73cd16d6a483dafb76179b21f329ea1fef00
-
SHA256
0f7ff1dda72f7da756a8efb610c9bba0a574442a8a8b48413dda54981d28c4af
-
SHA512
557b9c3743e5286ab3f21026dfab97c2608f47855a456aaf7cc893b39cfa57dc0df3000715b5da1f0993c4e6d06e84713329e2b190fd10f0d5a67b045da344db
-
SSDEEP
393216:H7UhQ5zzPiYfcLYnzjbLYg/GXv2pXpH9P3il/gsHoEl8h/lt8/QH:EQpKYf+CLHGm9PggsHzylt8i
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3916 vlc.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3916 vlc.exe 3836 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3836 taskmgr.exe Token: SeSystemProfilePrivilege 3836 taskmgr.exe Token: SeCreateGlobalPrivilege 3836 taskmgr.exe Token: 33 3836 taskmgr.exe Token: SeIncBasePriorityPrivilege 3836 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3836 taskmgr.exe 3836 taskmgr.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3916 vlc.exe 3836 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3916 vlc.exe 3916 vlc.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3836 taskmgr.exe 3836 taskmgr.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3916 vlc.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3916 vlc.exe 3836 taskmgr.exe 3836 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3916 vlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ED62B6BD122.exe"C:\Users\Admin\AppData\Local\Temp\ED62B6BD122.exe"1⤵PID:2624
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3836
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1576
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ShowRevoke.AAC"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77B
MD58eef0fe431b987cb31b666b746a0f3c2
SHA1cfeace2740e1cfa87e130f95433fdd55fe78291f
SHA2569696427a3ab2b870345e67f0f3259f09e0b531a42b39c3247ac583b7b6551fab
SHA512d6a8532368d08eebf94534be8289915f8c1d83de9ddeb9191c286436ab7c9cb1872f3326a45941895d93765eaa1bdc6f17632ae1b68842983267e3bdb4097878