Analysis
-
max time kernel
93s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 18:02
Static task
static1
Behavioral task
behavioral1
Sample
New Text Document.txt
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
New Text Document.txt
Resource
win11-20240508-en
windows11-21h2-x64
5 signatures
300 seconds
General
-
Target
New Text Document.txt
-
Size
1B
-
MD5
c4ca4238a0b923820dcc509a6f75849b
-
SHA1
356a192b7913b04c54574d18c28d46e6395428ab
-
SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
-
SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 548 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 844 taskmgr.exe Token: SeSystemProfilePrivilege 844 taskmgr.exe Token: SeCreateGlobalPrivilege 844 taskmgr.exe Token: 33 844 taskmgr.exe Token: SeIncBasePriorityPrivilege 844 taskmgr.exe Token: SeDebugPrivilege 548 tasklist.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe 844 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5048 wrote to memory of 548 5048 cmd.exe 102 PID 5048 wrote to memory of 548 5048 cmd.exe 102
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"1⤵PID:1956
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:844
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\system32\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:548
-