Analysis

  • max time kernel
    51s
  • max time network
    53s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 20:21

General

  • Target

    Anvil Loader.exe

  • Size

    6.3MB

  • MD5

    bdc6760fc3a5e0f4ac757abd6ef48549

  • SHA1

    5e43cc1e39b521d81ec3ba8c57470966f3c0954c

  • SHA256

    f6d7e67f3838b83f4378321b39c60cdff513176e1e8deb73da0dec27f7ebaebe

  • SHA512

    5c20d3302f9cab9ae5fb559b4ceebe143d9af1403acabde18f0d1b4760e0f1390601f710d7e3c66ce87c5d810a85c806f6dd87c58621097d78e7bd95ef805677

  • SSDEEP

    98304:dfRvYwz5xbn6sR6TAnkmcfCIwNlqOgq0qRaEOg4Xhmz4c583XafejbYGDrA:ZxZnJR6TAXb7hgrqtJehmzzejki8

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Anvil Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Anvil Loader.exe"
    1⤵
      PID:4816
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5044

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4816-0-0x0000000000E40000-0x0000000001C79000-memory.dmp

      Filesize

      14.2MB

    • memory/5044-1-0x0000022236280000-0x0000022236281000-memory.dmp

      Filesize

      4KB

    • memory/5044-3-0x0000022236280000-0x0000022236281000-memory.dmp

      Filesize

      4KB

    • memory/5044-2-0x0000022236280000-0x0000022236281000-memory.dmp

      Filesize

      4KB

    • memory/5044-7-0x0000022236280000-0x0000022236281000-memory.dmp

      Filesize

      4KB

    • memory/5044-13-0x0000022236280000-0x0000022236281000-memory.dmp

      Filesize

      4KB

    • memory/5044-9-0x0000022236280000-0x0000022236281000-memory.dmp

      Filesize

      4KB

    • memory/5044-12-0x0000022236280000-0x0000022236281000-memory.dmp

      Filesize

      4KB

    • memory/5044-11-0x0000022236280000-0x0000022236281000-memory.dmp

      Filesize

      4KB

    • memory/5044-10-0x0000022236280000-0x0000022236281000-memory.dmp

      Filesize

      4KB

    • memory/5044-8-0x0000022236280000-0x0000022236281000-memory.dmp

      Filesize

      4KB