Analysis
-
max time kernel
114s -
max time network
112s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-06-2024 11:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
065de95947fac84003fd1fb9a74123238fdbe37d81ff4bd2bff6e9594aad6d8b.exe
Resource
win11-20240508-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
065de95947fac84003fd1fb9a74123238fdbe37d81ff4bd2bff6e9594aad6d8b.exe
-
Size
1.8MB
-
MD5
1224b61e311739a9e50c05ecc3c07204
-
SHA1
e87f376059327c27b68e33e0000fe5a5c4323ebc
-
SHA256
065de95947fac84003fd1fb9a74123238fdbe37d81ff4bd2bff6e9594aad6d8b
-
SHA512
f7c57c42f2f6f2e719d502d5b8554a0adf8dedd1d848f7211f5e8d9936c1d6c152e3b2a4f2ee1d6f50c70b26b5f5a03628ebd5888aaa95e5e3cc5bca8e321058
-
SSDEEP
49152:lepFknuxpp+ooo8NpproooWWpqoooWtwWvTuf:le
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2540 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2540 Taskmgr.exe Token: SeSystemProfilePrivilege 2540 Taskmgr.exe Token: SeCreateGlobalPrivilege 2540 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe 2540 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1592 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\065de95947fac84003fd1fb9a74123238fdbe37d81ff4bd2bff6e9594aad6d8b.exe"C:\Users\Admin\AppData\Local\Temp\065de95947fac84003fd1fb9a74123238fdbe37d81ff4bd2bff6e9594aad6d8b.exe"1⤵PID:2492
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1132
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2540
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1592