Analysis
-
max time kernel
289s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 23:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
orthodox.exe
Resource
win7-20240508-en
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
orthodox.exe
Resource
win10v2004-20240226-en
5 signatures
300 seconds
General
-
Target
orthodox.exe
-
Size
1.8MB
-
MD5
15c7b84efb6e1185cbb8f68898b3d2cf
-
SHA1
153b7ec96bf2997205c28de525de658dddc49232
-
SHA256
88019645c39dbd895dbdf510bf553b841859537a173df4c1bd8dc5e154cc267a
-
SHA512
3429192e7bbf5e0ce657eef59551652081c64485a3eadaf9d9ac810184334b8ea0a128f150778c1e4f9605c4df8e14763c7a26233f83d90f4dfae816f590655a
-
SSDEEP
49152:1cmEHl5+VvoeFMIpRnCsOTVE6iBunMODY:OmuIoeFLiTIODY
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2756 taskmgr.exe Token: SeSystemProfilePrivilege 2756 taskmgr.exe Token: SeCreateGlobalPrivilege 2756 taskmgr.exe Token: 33 2756 taskmgr.exe Token: SeIncBasePriorityPrivilege 2756 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\orthodox.exe"C:\Users\Admin\AppData\Local\Temp\orthodox.exe"1⤵PID:4964
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2756
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:3128